Is CVE-2026-32305 actively exploited?

No active exploitation of CVE-2026-32305 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32305 be exploited remotely?

Yes. CVE-2026-32305 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32305?

CVE-2026-32305 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32305

MEDIUM

CVE-2026-32305

CWE-287Published: March 20, 2026· Updated: Mar 24, 2026

5.3

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.1th

Official Description

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 are vulnerable to mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services that should require mutual TLS authentication. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.

NVD Source

Technical Analysis

CVE-2026-32305 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.