CVE-2026-53622

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.17 through 3.7.1

Description An issue in the HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mutual TLS (mTLS) enforcement. When HTTP/3 is enabled, the TLS handshake uses an exact, case-sensitive lookup on the Server Name Indication (SNI) value to select the TLS configuration. This process fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Consequently, the handshake falls back to the default TLS configuration, which may not require client certificates. However, the subsequent HTTP routing layer still matches the request to a backend protected by an mTLS policy, allowing the request to proceed without authentication.

Technical details include:

Recommendations Update to version 3.7.3 or later. As a temporary workaround, disable HTTP/3 on entrypoints that rely on router-specific mTLS. As a temporary workaround, enforce mTLS in the default TLS options to ensure the fallback configuration is not weaker than router-specific settings. As a temporary workaround, block UDP access to the HTTP/3 entrypoint. As a temporary workaround, enforce client authentication at an additional layer behind the software.