Traefik versions prior to v2.11.58 and v3.7.14 suffer from an authentication bypass that skips the SNI check when the TLS state is nil. This flaw allows an unauthenticated client posing as a TLS connection to send HTTP/2 requests that include a :scheme http pseudo-header. When executed against a Go 1.27 build, the request reaches routers that require client certificates, thereby granting access without presenting a valid certificate. The vulnerability undermines the intended TLS client authentication, potentially exposing protected services to unauthorized users. Its CVSS score of 7 indicates a medium to high severity.

All deployments of Traefik using versions older than v2.11.58 in releases 2.x or older than v3.7.14 in releases 3.x are affected. The vulnerability applies to any instance where client certificate authentication is enabled and the build is based on Go 1.27.

The bug can be triggered remotely by an attacker who can direct crafted TLS traffic to the Traefik instance. No local privilege escalation is required, as the flaw exploits a server-side configuration check that is bypassed. While the EPSS score is not reported, the lack of listing in the CISA KEV catalog suggests that widespread exploitation has not yet been observed. Nonetheless, the high impact on authentication integrity warrants prompt remediation.