CVE-2026-53622: traefik

Vulnerability summary

CVE-2026-53622 is a critical (CVSS 10.0) vulnerability in traefik. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-06-2026
   PublishedVulnerability first disclosed.
2. 02-09-2026
   Last modifiedVulnerability information updated.

Description

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in versions 3.7.3, 3.6.18, and 2.11.51.

• CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
• CWE-289Authentication Bypass by Alternate NameThe product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.