CVE WatchJul 15, 2026

CVE-2026-48491

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-front

CVSS

10.0

Critical

EPSS

0.2%

p16

KEV

—

Exploit Today

0-100

Published: Jun 23, 2026 · Last modified: Jul 15, 2026 · CWE-288 · CWE-807

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-06-302026-07-19

Technical description

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientCert), SNICheck resolves the TLS options for the HTTP Host header using exact map lookups only and never applies wildcard matching. If another permissive SNI is served on the same entrypoint, an attacker can complete the TLS handshake under the permissive options and then send an HTTP Host header targeting the wildcard-protected backend, reaching it without presenting a client certificate. This affects the regular HTTPS / HTTP-2 path and does not require HTTP/3. This vulnerability is fixed in 3.7.3.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-555919.8 CRI

99.9%

KEV—80Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability11d CVE-2025-244728.1 HIG

86.3%

KEV—76Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability11d CVE-2026-344867.5 HIG

97.4%

——29Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.5d CVE-2026-445757.5 HIG

72.4%

——22Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.3d CVE-2023-370579.8 CRI

56.3%

——17An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.11d CVE-2026-241209.8 CRI

55.5%

——17vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5.5d