What’s Vulnerable › Vulnerabilities

CVE-2022-46153: Routes exposed with an empty TLSOption in traefik

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-08 · updated 2026-06-17
• Weakness: CWE-295

Description

Traefik is an open source HTTP reverse proxy and load balancer. In affected versions there is a potential vulnerability in Traefik managing TLS connections. A router configured with a not well-formatted TLSOption is exposed with an empty TLSOption. For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates. Users are advised to upgrade to version 2.9.6. Users unable to upgrade should check their logs to detect the error messages and fix your TLS options.

Affected products

• Traefik: before 2.9.6 — fixed in 2.9.6

How to fix

Upgrade to a fixed version: Traefik 2.9.6. Check the vendor advisory for mitigations.

References

• https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options
• https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a
• https://github.com/traefik/traefik/releases/tag/v2.9.6
• https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v
• https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options
• https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a
• https://github.com/traefik/traefik/releases/tag/v2.9.6
• https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v

Get alerted when CVE-2022-46153 or the next vulnerability affects your stack