CVE-2026-53622 is an authentication bypass (CWE-288) in Traefik that lets clients skip router-specific mTLS over HTTP/3, scored 10.0 critical. It needs several conditions together to apply to you. Upgrade to Traefik 3.7.3, 3.6.18 or 2.11.51, or turn off HTTP/3 on the affected entrypoint.
What's affected
Traefik before 3.7.3, before 3.6.18 and before 2.11.51, per the CVE record. Fixed versions are 3.7.3, 3.6.18 and 2.11.51.
The record says all of these must be true for exposure: HTTP/3 is enabled on an entrypoint; a router uses a wildcard Host rule or case-insensitive hostname matching; a router-specific TLS option enforces client certificate authentication; and UDP access to the entrypoint is reachable by the attacker.
Deployments without HTTP/3, or those that apply mTLS through the default TLS option for the whole entrypoint, do not match the described conditions.
How to check if you're exposed
Find the version:
traefik version
docker exec <container> traefik version
Then test the conditions against your configuration. Look for HTTP/3 on any entrypoint in your static configuration:
grep -rniE "http3" /etc/traefik/ ./traefik*.y*ml
Next, find routers that use wildcard host rules and a tls.options setting that requires client certificates. If HTTP/3 is on and both are present, treat the router as exposed. Also check whether UDP on your entrypoint port is open to the internet.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- List Traefik instances and their versions, including the ones in Kubernetes ingress setups.
- Upgrade to 3.7.3, 3.6.18 or 2.11.51 for your release line.
- Where you cannot upgrade at once, disable HTTP/3 on the entrypoint, or block UDP access to it at the firewall.
- Review routers that depend on router-specific mTLS and consider enforcing client certificates in the default TLS option as an extra layer.
- Check backend access logs for requests with no client certificate identity on routes that should have one.
- Add an application level check of the client identity for the most sensitive backends.
Why it matters
Traefik picks a TLS configuration during the handshake, before it knows which router will handle the request. The record says that for HTTP/3 the lookup is an exact, case-sensitive match on the SNI value. That fails to match wildcard host patterns or case variants, so the handshake falls back to the default TLS configuration, which may not ask for a client certificate.
Later, the HTTP routing layer still sends the request to the backend guarded by the router-specific mTLS policy. The two decisions disagree, and the stricter one never ran. The weaknesses are CWE-288, authentication bypass using an alternate path, and CWE-289, bypass by alternate name.
The lesson reaches beyond this CVE. When security configuration is chosen in one layer and routing in another, they must use the same matching rules. The record does not report exploitation, and the CVE is not in the CISA KEV catalog. The 10.0 score reflects a changed scope with no privileges needed, but the listed conditions narrow real exposure considerably.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect HTTP/1.1 and HTTP/2?
The record ties the flaw to HTTP/3 over QUIC. Without it, the described path does not exist.
Is a CVSS of 10.0 realistic for me?
Only if all the listed conditions hold. Check them one by one in your configuration.
Sources
Last reviewed: 19 October 2026.
