FIND-20260404-003 · 2026-04-04 · Innovation Veille

CVE-2026-32305: Traefik mTLS Bypass via Fragmented TLS ClientHello (CVSS 7.8) — Fixed in v3.6.11+

cve HIGH
CVE-2026-32305 (CVSS v4.0: 7.8) is a mutual TLS bypass in Traefik affecting all versions before 3.6.11 and 2.11.41. When a TLS ClientHello is fragmented across multiple TCP records, Traefik's SNI extraction fails and falls back to the default TLS config which does not require client certificates. An unauthenticated remote attacker can bypass route-level mTLS enforcement with no user interaction required. Fixed in Traefik 3.6.11 (released March 2026). ODS currently tracks Traefik 3.6.12 in last-versions.json which already includes this fix. Two additional CVEs were fixed in 3.6.12: CVE-2026-33433 (BasicAuth/DigestAuth identity spoofing via non-canonical header) and CVE-2026-33186.

Source

https://github.com/advisories/GHSA-wvvq-wgcr-9q48

ODS Impact

Traefik is the ODS API Gateway. If ODS is running any version of Traefik below 3.6.11, mTLS enforcement protecting internal service-to-service communication can be bypassed. Traefik 3.6.12 (already in last-versions.json) contains all fixes. Verify the deployed Traefik container version on srv-staging and ensure it is 3.6.12 or later.

Security Review

N/A

Tags

traefik cve mtls tls api-gateway security high-severity