SB2026050533 - Multiple vulnerabilities in Traefik
Published: May 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Authentication Bypass by Primary Weakness (CVE-ID: CVE-2026-32305)
The vulnerability allows a remote attacker to bypass mutual TLS authentication and access services protected by route-level mTLS.
The vulnerability exists due to improper security decision based on incomplete input in TLS SNI pre-sniffing logic when processing fragmented TLS ClientHello records. A remote attacker can send a specially crafted fragmented ClientHello to bypass mutual TLS authentication and access services protected by route-level mTLS.
Exploitation requires route-level TLS options to enforce mTLS for a host while the default TLS configuration is weaker and pre-sniff SNI extraction fails with an empty SNI.
2) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-32595)
The vulnerability allows a remote attacker to enumerate valid usernames.
The vulnerability exists due to observable timing discrepancy in the BasicAuth middleware when validating submitted credentials. A remote attacker can send authentication requests and measure response times to enumerate valid usernames.
Only deployments with the BasicAuth middleware enabled are vulnerable.
The vulnerability allows a remote user to bypass host and header routing constraints and redirect unauthorized traffic to victim services.
The vulnerability exists due to improper neutralization of special elements in output used by a downstream component in Traefik Kubernetes Knative provider router rule construction when interpolating user-controlled host or header values into backtick-delimited rule expressions. A remote user can create or update a crafted Knative Ingress resource to bypass host and header routing constraints and redirect unauthorized traffic to victim services.
Exploitation depends on admission or validation policy and on the ability to create or modify Knative Ingress resources in shared or multi-tenant deployments.
Remediation
Install update from vendor's website.