Traefik versions 2.11.40 and earlier, 3.0.0‑beta1 through 3.6.11, and 3.7.0‑ea.1 contain a flaw in the SNI pre‑sniffing logic that can be triggered by a fragmented TLS ClientHello. When the hello message is split across multiple records, the SNI extraction fails and the router receives an empty host name. The TCP router then falls back to the default TLS configuration, which does not require client certificates. This flaw allows an attacker to bypass the route‑level mutual TLS enforcement and connect to services that should only be reachable with client authentication, thereby exposing confidential communications and potentially allowing further exploitation. The weakness is rooted in improper input handling (CWE‑1188) combined with insufficient verification of critical security parameters (CWE‑179) and incorrect authentication logic (CWE‑287).

Traefik, the open‑source HTTP reverse proxy and load balancer, is affected. The problematic versions are 2.11.40 and all earlier releases, 3.0.0‑beta1 through 3.6.11, and the early access release 3.7.0‑ea.1. Users running any of these builds should review their deployment and update to a fixed version.

The vulnerability is rated high with a CVSS score of 7.8, but the low EPSS score of less than one percent indicates that it is not frequently exploited in the wild. It is not listed in the CISA KEV catalog. The attack can be performed remotely by an adversary who can send a specially crafted fragmented TLS ClientHello to a Traefik instance that has route‑level mTLS enabled. No special privileges are required on the server side, making the threat moderate to high for exposed deployments. Prompt remediation is therefore recommended.