Traefik’s SNICheck component fails to apply wildcard matching when resolving TLSOptions for HTTP Host headers, allowing an unauthenticated client to bypass mutual TLS requirements that are enforced on routers using wildcard host rules. The vulnerability permits an attacker to complete a TLS handshake under permissive options and then target a backend protected by a wildcard‑enforced client‑certificate policy, effectively subverting the intended security posture. This flaw falls under CWE‑288, indicating a security misconfiguration that elevates the risk of unauthorized data access or privilege escalation. The CVSS score of 7.8 reflects a high severity impact on confidentiality and integrity for affected services.

The issue affects Traefik, the HTTP reverse proxy and load balancer, for all releases from version 3.7.0 through 3.7.3 inclusive. Any deployment using a wildcard host rule (e.g., Host(*.example.com)) with stricter TLSOptions such as RequireAndVerifyClientCert is vulnerable unless the software is updated beyond 3.7.3.

The attacker does not require authentication and can exploit the flaw from any client capable of initiating a TLS handshake on a permissive SNI served by the same entrypoint as the protected router. The exploit path takes advantage of SNICheck’s exact‑match lookup function, which ignores wildcard TLSOptions. As the EPSS score is unavailable, the likelihood of exploitation remains uncertain, but the vulnerability has not been listed in the CISA KEV catalog. Given the high CVSS score and the low complexity of the attack—merely choosing an appropriate SNI and HTTP Host header—the threat level is significant, especially for services exposed to untrusted networks.