CVE-2026-85597 is a client certificate bypass in Traefik TLS option conflict handling (CVSS 9.1, critical). A conflict on one host of a multi host router drops mTLS for all of them. Upgrade to v2.11.55 or v3.7.11. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists Traefik up to v2.11.54 and from v3.0.0 through v3.7.10. Patched versions are v2.11.55 and v3.7.11. The weakness is CWE-863, incorrect authorization.
TLS options are applied during the handshake, so they map to the host names in a router rule, not to the router. When several routers on one entry point serve the same host with different options, Traefik falls back to default options, and for a multi host router that fallback covered every host in the rule. A client without a certificate could then reach a protected backend. The fix adds a core.strictTLSOptions static option that disables the fallback and marks conflicting routers as errors. The record is not in the CISA KEV catalog.
How to check if you're exposed
Find routers whose rules list several hosts and that require client certificates.
grep -rn "tls.options\|clientAuth" /etc/traefik/ ./config/ 2>/dev/null
Then check the Traefik version in use. Review the advisory for the default of the new strictTLSOptions option on your release line before you change it.
What to do now
- Upgrade to v2.11.55 or v3.7.11 or later.
- Enable core.strictTLSOptions as described in the advisory so conflicts produce errors, not fallbacks.
- Avoid multi host router rules where hosts carry different TLS options.
- Test from a client with no certificate that protected hosts refuse the connection.
- Add backend side checks where you rely on the proxy for client identity.
Why it matters
TLS negotiation happens before HTTP routing, so the proxy chooses options from the host name alone. That design makes conflicts hard to resolve cleanly, and the old choice was to fall back to the default.
The new strict mode turns a silent downgrade into a visible error. That is a better trade for any control meant to keep people out.
Quick check
What is the difference from CVE-2026-85596?
That one is specific to the Ingress NGINX provider on v3.7. This one is in the core conflict logic and reaches back to v2 and v3.0.
Sources
Last reviewed: 19 October 2026.
