CVE-2022-23632: Traefik v2 FQDN Router TLS Configuration Bypass
Summary
CVE-2022-23632: Skip the router TLS configuration when the host header is an FQDN. Affects github.com/traefik/traefik/v2 versions < 2.6.1. Fixed in 2.6.1. How to fix ↓
Also tracked for
The same CVE-2022-23632 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Traefik v2 is an open-source reverse proxy and load balancer that provides routing and load balancing for HTTP and TCP-based applications. It is written in Go and is widely used in production environments. Traefik allows users to configure routers to handle incoming requests and apply TLS configurations for secure communication. However, a vulnerability in Traefik v2 versions prior to 2.6.1 allows the TLS configuration to be bypassed when the host header is a fully qualified domain name (FQDN). This can lead to the use of an incorrect TLS configuration, potentially compromising the security of mTLS connections between Traefik and clients.
Vulnerability Detail
The vulnerability arises when a request is sent using an FQDN that is handled by a router with a dedicated TLS configuration. In such cases, the TLS configuration falls back to the default configuration, which may not match the intended configuration. Additionally, if CNAME flattening is enabled, the selected TLS configuration is based on the SNI value, while the routing uses the CNAME value. This mismatch can result in the bypass of the expected TLS configuration. The impact of this vulnerability is primarily on users who have configured mTLS between Traefik and clients.
How To Fix
Latest published version: v2.11.60 as of 22 Oct 2026
go get github.com/traefik/traefik/v2@v2.11.60Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.1
This is the first release that contains the fix.
go get github.com/traefik/traefik/v2@v2.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to Traefik v2.6.1 is not immediately feasible, a workaround can be implemented by adding the FQDN to the host rule in the router configuration. For example:
whoami:
image: traefik/whoami:v1.7.1
labels:
traefik.http.routers.whoami.rule: Host(`whoami.example.com`, `whoami.example.com.`)
traefik.http.routers.whoami.tls: true
traefik.http.routers.whoami.tls.options: mtls@file
Please note that this workaround is not applicable if CNAME flattening is enabled.
Conclusion
The vulnerability in Traefik v2 versions prior to 2.6.1 allows the bypass of router TLS configuration when the host header is an FQDN. This can lead to the use of an incorrect TLS configuration, potentially compromising the security of mTLS connections. Users should upgrade to Traefik v2.6.1 or later to fix this vulnerability. If immediate upgrade is not possible, a workaround can be implemented by adding the FQDN to the host rule in the router configuration. For further assistance on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/traefik/traefik/v2 →
FAQ
Traefik v2 is an open-source reverse proxy and load balancer that provides routing and load balancing for HTTP and TCP-based applications.
mTLS (mutual Transport Layer Security) is a security mechanism that requires both the client and the server to present valid certificates to establish a secure connection.
The vulnerability can result in the use of an incorrect TLS configuration, potentially compromising the security of mTLS connections between Traefik and clients.
Upgrade to Traefik v2.6.1 or later to apply the patch that addresses the TLS configuration bypass issue.
Yes, you can add the FQDN to the host rule in the router configuration as a workaround. However, this workaround is not applicable if CNAME flattening is enabled.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/traefik/traefik/v2.
