CVE-2026-53622: Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

Synopsis

An authentication bypass vulnerability exists in Traefik's HTTP/3 (QUIC) TLS configuration selection. The flaw is reachable over the network without any credentials, because an exact case-sensitive SNI lookup fails to match wildcard host patterns or case variants, causing the handshake to fall back to a default TLS configuration that may not require client certificates. A remote, unauthenticated attacker can complete the QUIC handshake without presenting a client certificate and reach backends that should be protected by mutual TLS (mTLS), gaining unauthorized read and write access to those services. A patched-image rebuild at version 3.7.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Traefik entrypoint over the network via UDP (QUIC/HTTP/3); no local or physical access is needed.

• AuthenticationNot required

  No credentials or client certificate are needed; the exploit works precisely because the mTLS requirement is bypassed during the QUIC handshake.

• Victim interactionNot required

  The attack is fully client-driven and requires no action from an administrator or end user.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: the attacker simply sends a QUIC ClientHello with a SNI value that does not exactly match the configured hostname, triggering the fallback without any race conditions or environmental tuning.

Blast Radius

• An attacker reads responses from backends that should be restricted to mTLS-authenticated clients, exposing any data those services return (API responses, internal records, session tokens).
• An attacker sends arbitrary requests to those same backends, modifying persisted state, triggering privileged operations, or injecting data, because the HTTP routing layer still dispatches the request normally after the handshake completes.
• Any backend service protected solely by a router-specific TLSOptions mTLS policy and exposed over HTTP/3 is reachable as if no client-certificate requirement existed.