CVE Intelligence
Analysis AI-assisted

CVE-2026-48491: Traefik SNICheck Wildcard TLSOptions mTLS Bypass

CVE-2026-48491 affects Traefik versions 3.7.0 up to 3.7.3, where the SNICheck domain-fronting protection does not apply wildcard TLS options to the HTTP Host header. According to the record, an unauthenticated client may reach a wildcard-protected backend without presenting a client certificate. The issue is fixed in 3.7.3, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Traefik is an HTTP reverse proxy and load balancer. CVE-2026-48491 concerns its domain-fronting protection (SNICheck), which according to the GitHub advisory can let an unauthenticated client reach a wildcard-protected backend without presenting a client certificate when mutual TLS was expected. The record describes affected versions from 3.7.0 up to, but not including, 3.7.3.

Impact

  • Unauthenticated clients may bypass mutual TLS enforced through wildcard router TLSOptions.
  • The record describes the regular HTTPS / HTTP-2 path and states that HTTP/3 is not required.
  • NVD lists a CVSS 3.1 base score of 10.0 with high confidentiality and integrity impact and no availability impact, while GitHub lists 7.8 under CVSS 4.0.

Affected products and versions

  • Product: Traefik Traefik.
  • Affected range: 3.7.0 up to but not including 3.7.3.
  • Fixed in: 3.7.3, according to the record and the release page.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record, and no confirmed active exploitation appears in the sources consulted. The GitHub advisory reference carries an 'Exploit' tag in the record, but the record does not describe exploitation details or evidence of attacks.

Remediation and mitigation

  • Upgrade Traefik to 3.7.3 or later, as stated in the release notes and the advisory.
  • Until the upgrade is applied, review routers that combine wildcard host rules with stricter TLS options, and inventory entrypoints that also serve permissive SNI.
  • The record does not describe a documented workaround, so whether one exists is unknown.

Detection guidance

  • Inventory Traefik versions across proxies and identify instances in the affected range.
  • Review configuration for wildcard host rules paired with client-certificate requirements.
  • Where logging allows, monitor access logs for requests to protected backends that lack client certificate identity. This is a high-level suggestion, not a validated detection signature.

Limitations of the available information

  • The record is marked Modified, so sources may change.
  • Three CVSS scores from different providers and versions appear, and the record does not identify the basis of the 9.1 score.
  • EPSS and SSVC data are absent.
  • The record does not provide detailed proof of concept or validated detection signatures, and this analysis does not add them.

Frequently asked questions

Which Traefik versions are affected by CVE-2026-48491?

The record lists versions from 3.7.0 up to but not including 3.7.3 as affected.

What is the fixed version?

The record and the Traefik release page indicate that version 3.7.3 contains the fix.

Is this vulnerability known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.