7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-48491

CVE-2026-48491: Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientCert), SNICheck resolves the TLS options for the HTTP Host header using exact map lookups only and never applies wildcard matching. If another permissive SNI is served on the same entrypoint, an attacker can complete the TLS handshake under the permissive options and then send an HTTP Host header targeting the wildcard-protected backend, reaching it without presenting a client certificate. This affects the regular HTTPS / HTTP-2 path and does not require HTTP/3. This vulnerability is fixed in 3.7.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-48491

CVE-2026-48491:

7.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
Traefik	go	>= 3.7.0, <= 3.7.1	3.7.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-5r4w-85f3-pw66, allows an attacker to bypass mutual TLS (mTLS) checks on Traefik routers that use wildcard host rules. The root cause lies in the SNICheck middleware, which is responsible for preventing domain-fronting attacks by ensuring the TLS Server Name Indication (SNI) and the HTTP Host header resolve to the same TLS configuration.

The analysis of the provided patch, specifically commit 34c0abaaf4b3d23213961b3e103beebc8e17de71, reveals that the logic for this check was flawed. The vulnerable implementation, located in pkg/middlewares/snicheck/snicheck.go, used the functions findTLSOptionName and findTLSOptName to look up the TLS options for a given hostname. These functions only performed exact-string lookups and did not have the capability to match a hostname against a wildcard rule (e.g., matching api.example.com to *.example.com).

When an attacker sends a request using a permissive SNI (e.g., public.example.net) to establish the TLS session, and then specifies a Host header for a wildcard-protected domain (e.g., api.example.com), the vulnerable SNICheck fails. It cannot find a matching wildcard rule for api.example.com in its map and incorrectly falls back to the default TLS options. If the permissive SNI also uses default options, SNICheck sees no mismatch and allows the request to proceed, effectively bypassing the stricter mTLS requirement of the wildcard route.

The patch rectifies this by completely redesigning the mechanism. Instead of SNICheck re-simulating the routing logic, the actual TLS option name used during the TLS handshake is now injected into the request's context. The new SNICheck middleware, now attached to each router, simply compares this context value with its own configured TLS option name. This new approach is not susceptible to the wildcard resolution flaw because it relies on the correct routing components to supply the ground truth about the connection's TLS state.

Vulnerable functions

snicheck.ServeHTTP

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.