CVE-2026-48491: Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Synopsis

An authentication bypass vulnerability exists in Traefik versions 3.7.0 through 3.7.2, affecting the SNICheck domain-fronting protection layer. The flaw is reachable over the network with no credentials required: an unauthenticated attacker on the internet can complete a TLS handshake using a permissive SNI on the same entrypoint, then send an HTTP Host header targeting a backend that is supposed to require mutual TLS (client certificate verification), bypassing that requirement entirely. Successful exploitation lets the attacker read data from and write data to backends that should have been protected by mTLS. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Traefik entrypoint over the network; exposure to the internet or any network path to the HTTPS listener is sufficient.

• AuthenticationNot required

  No credentials or client certificate are needed; the attacker initiates the bypass as a fully unauthenticated client.

• Victim interactionNot required

  The attacker acts entirely on their own; no action by an operator, user, or backend service is required to trigger the bypass.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the attacker simply connects with a permissive SNI on the shared entrypoint and then sends a crafted Host header, with no race conditions or special memory layout required.

Blast Radius

• Reads responses from mTLS-protected backends that should have rejected the connection, exposing any data those services return including API responses, session tokens, or internal records.
• Sends arbitrary requests to wildcard-protected backends, allowing modification of application state, triggering of privileged operations, or injection of malicious payloads into backend processing pipelines.
• Undermines the mTLS boundary entirely for any router using a wildcard Host rule with stricter TLSOptions on an entrypoint that also serves a permissive SNI, potentially affecting multiple backends behind the same Traefik instance.