CVE-2026-48491

[CVE catalog]

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability allows an unauthenticated client to bypass mutual Transport Layer Security (TLS) enforcement, a security measure that verifies both client and server identities. The bypass occurs due to an issue in Traefik's domain-fronting protection (SNICheck), which incorrectly processes TLS options for HTTP Host headers. As a result, an attacker can gain unauthorized access to protected backend services without presenting a required client certificate. Traefik: Traefik: Unauthorized access due to mutual TLS bypass This is an Important flaw in Traefik that allows an unauthenticated client to bypass mutual TLS authentication. The vulnerability arises from an issue in Traefik's domain-fronting protection when specific wildcard host rules with strict TLS options are used alongside permissive SNI configurations on the same entrypoint. This bypass enables unauthorized access to protected backend services, undermining critical access controls. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Published

Jun 16, 2026, 7:02:20 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.36% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "traefik",
      "ecosystem": "cpe",
      "fixed_version": "3.7.3"
    },
    {
      "name": "github.com/traefik/traefik/v2",
      "ecosystem": "go",
      "fixed_version": "2.11.48",
      "provider_record_id": "GHSA-5R4W-85F3-PW66"
    },
    {
      "name": "github.com/traefik/traefik/v3",
      "ecosystem": "go",
      "fixed_version": "3.7.3",
      "provider_record_id": "GHSA-5R4W-85F3-PW66"
    },
    {
      "name": "traefik",
      "ranges": [
        {
          "fixed": "3.7.3",
          "introduced": "3.7.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "3.7.3",
      "provider_record_id": "NVD-CVE-2026-48491"
    }
  ]
}