Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts in github.com/traefik/traefik
Traefik's HTTP/3 TLS configuration selection is vulnerable to a bypass when using wildcard or mixed-case hosts in the SNI. The HTTP/3 (QUIC) path performed a direct, case-sensitive lookup on the SNI value to select the applicable TLS configuration. This lookup failed to match wildcard host patterns (e.g., "*.example.com") or case variants of configured hostnames. In these cases, Traefik would fall back to the default TLS configuration, which might not enforce mutual TLS (mTLS), allowing unauthenticated clients to access protected backends.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-53622US | critical10.0OT erhöht | — | ||
Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selectio… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan