Executive brief
Traefik is a popular open-source tool used to route and balance web traffic to different applications. A security flaw in its handling of modern HTTP/3 (QUIC) connections allows attackers to bypass security rules that require a digital certificate for access. This means an unauthorized user could potentially access private internal services that were supposed to be protected by mutual TLS (mTLS) authentication.
Technical details
A vulnerability exists in Traefik's HTTP/3 (QUIC) TLS configuration selection logic. When HTTP/3 is enabled, the TLS handshake performs an exact, case-sensitive map lookup on the SNI value to select the appropriate TLS configuration. This lookup fails for wildcard host patterns (e.g., *.example.com) or mixed-case variants of a hostname. In these cases, Traefik falls back to the default TLS configuration. If the default configuration does not require client certificates, an unauthenticated attacker can complete the handshake and reach backends that were intended to be protected by router-specific mTLS policies. This issue is resolved in version 3.7.3.
Affected products
- Traefik Traefik < 3.7.3
Timeline
- 2026-06-04: patched: Version 3.7.3 released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-9cr8-q42q-g8m7 published
- 2026-06-23: disclosed: CVE-2026-53622 published to NVD