Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-06-23T19:13:28 github.com/traefik/traefik: Traefik: mTLS enforcement bypass due to HTTP/3 TLS configuration flaw 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE-289

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in 3.7.3.

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mutual Transport Layer Security (mTLS) enforcement. When HTTP/3 is enabled and a router uses wildcard host rules or case-insensitive hostname matching with client certificate authentication, an attacker can complete the QUIC handshake without presenting a certificate. This bypass grants unauthorized access to a backend that should be protected by mTLS.

This Important flaw in Traefik, as shipped in Red Hat OpenShift Dev Spaces, allows unauthenticated clients to bypass mutual TLS (mTLS) enforcement when HTTP/3 (QUIC) is enabled. An attacker can gain unauthorized access to mTLS-protected backends if the Traefik router uses wildcard host rules or case-insensitive hostname matching, circumventing expected client certificate authentication. To mitigate this issue, disable HTTP/3 (QUIC) on Traefik entrypoints. This prevents the TLS configuration selection flaw that leads to mTLS bypass. Consult Traefik documentation for specific configuration steps to disable HTTP/3. Restarting the Traefik service will be required for the changes to take effect. Red Hat OpenShift Dev Spaces Affected devspaces/traefik-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-53622 https://nvd.nist.gov/vuln/detail/CVE-2026-53622 https://github.com/traefik/traefik/releases/tag/v3.7.3 https://github.com/traefik/traefik/security/advisories/GHSA-9cr8-q42q-g8m7