CVE-2026-53622

[CVE catalog]

Severity

Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Published

Jun 16, 2026, 9:04:29 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.63% · Oct 25, 2026

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mutual Transport Layer Security (mTLS) enforcement. When HTTP/3 is enabled and a router uses wildcard host rules or case-insensitive hostname matching with client certificate authentication, an attacker can complete the QUIC handshake without presenting a certificate. This bypass grants unauthorized access to a backend that should be protected by mTLS. github.com/traefik/traefik: Traefik: mTLS enforcement bypass due to HTTP/3 TLS configuration flaw This Important flaw in Traefik, as shipped in Red Hat OpenShift Dev Spaces, allows unauthenticated clients to bypass mutual TLS (mTLS) enforcement when HTTP/3 (QUIC) is enabled. An attacker can gain unauthorized access to mTLS-protected backends if the Traefik router uses wildcard host rules or case-insensitive hostname matching, circumventing expected client certificate authentication. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.