A critical vulnerability in Traefik allows unauthenticated attackers to bypass mTLS requirements, potentially exposing protected backends to unauthorized access.

This flaw is an authorization bypass (CWE-863) where conflicting TLS options on multi-host routers cause the application to default to insecure settings, allowing unauthenticated attackers to circumvent mandatory client-certificate authentication.

The ability to bypass mTLS authentication represents a severe risk to organizational security, as it negates the primary access control mechanism for internal services. Given the CVSS score of 8.2, this vulnerability could lead to the exposure of sensitive data or unauthorized interaction with internal APIs, resulting in significant potential for data breach or service compromise.

Immediate Action: Update Traefik to version 2.11.55 or later to resolve the TLS option conflict resolution flaw.

Proactive Monitoring: Review access logs for unusual patterns involving TLS handshakes or requests to protected backends that lack expected client-certificate validation.

Compensating Controls: Ensure strict firewall rules are in place to limit network access to sensitive backends, preventing direct reachability while the update is being staged.

Public Exploit Available: No

This high-severity vulnerability requires immediate attention due to its potential to facilitate unauthorized access to protected services. Administrators should prioritize upgrading to the patched versions provided by the vendor to eliminate the risk of mTLS bypass and ensure the integrity of authenticated traffic.