Homepage

Authentication Bypass Affecting traefik-2 package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.24% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TRAEFIK2-17369318
  • published18 Jun 2026
  • disclosed23 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 18 Jun 2026

NewCVE-2026-53622  (opens in a new tab)
CWE-288  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest traefik-2.

NVD Description

Note: Versions mentioned in the description apply only to the upstream traefik-2 package and not the traefik-2 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in 3.7.3.