Vulnerability in Traefik's HTTP/3 TLS Configuration Allows Bypass of mTLS Enforcement

CVE-2026-53622

What is CVE-2026-53622?

Traefik, an HTTP reverse proxy and load balancer, has a vulnerability related to its HTTP/3 TLS configuration selection. In versions prior to 3.7.3, unauthenticated clients can exploit this flaw to bypass router-specific mTLS enforcement. The vulnerability is due to the TLS handshake process, which employs a case-sensitive lookup for the SNI value, failing to match wildcard host patterns or case variations. This allows a client to complete a QUIC handshake without presenting a certificate, even when the backend is protected by mTLS policies. The issue arises under specific conditions, including the presence of HTTP/3, the use of wildcard Host rules, and the enforcement of client certificate authentication, posing significant security risks when an attacker has UDP access to the entrypoint.

References