Traefik versions earlier than 2.11.58 and 3.7.13 allow a client to bypass authentication checks that normally require a valid TLS client certificate. The flaw is caused by a bug in how negated Host matchers are handled; the router rule with !Host() is treated as a served domain and conflicts with TLS options that enforce RequireAndVerifyClientCert, causing the server to fall back to the default TLS options and skip the certificate check. This enables an attacker to connect to backends that are intended to be protected by mutual TLS from an unauthenticated connection, effectively compromising confidentiality and integrity of those services.

All installations running Traefik prior to version 2.11.58 or 3.7.13 are impacted. The affected deployable is the Traefik load‑balancer/edge router; any router rules that use a negated Host matcher (!Host()) in combination with RequireAndVerifyClientCert are vulnerable.

The vulnerability has a CVSS score of 6.9, indicating a high severity. EPSS information is not available, and the issue is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector involves an attacker sending a TLS client request to the router with a negated host matcher; the server then resolves the TLS options to the default set and ignores the client‑certificate requirement. No special privileges or additional conditions are mentioned, so remote exploitation over the network is possible from any unauthenticated client that can reach the router. The risk is therefore moderate to high for services that rely on mutual TLS for protection.