CVE-2026-32305 — Traefik mTLS Bypass via Fragmented TLS ClientHello (CVSS 7.8, HIGH)

Traefik versions prior to 2.11.41, 3.6.11, and 3.7.0-ea.2 contain a critical mTLS bypass vulnerability. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction fails with EOF and returns an empty SNI, causing the TCP router to fall back to the default TLS configuration — which does not require client certificates. This allows an unauthenticated attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS. CVSS 4.0 score 7.8 (High). ODS runs Traefik 3.6.13 as API Gateway — verify mTLS configurations are enforced.