GHSA-gv8r-9rw9-9697 Traefik affected by TLS ClientAuth Bypass on HTTP/3

Not scored Published 20 Feb 2026

Traefik allows bypassing TLS ClientAuth on HTTP/3, enabling unauthorized access when mutual TLS is configured.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is GHSA-gv8r-9rw9-9697?

GHSA-gv8r-9rw9-9697 is an authentication bypass vulnerability in github.com/traefik/traefik, published on 20 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Summary

There is a potential vulnerability in Traefik managing HTTP/3 connections.

More details in the CVE-2025-68121.

Patches

Workarounds

No workaround

For more information

If you have any questions or comments about this advisory, please open an issue.

Which versions are affected by GHSA-gv8r-9rw9-9697?

9 open source packages ship an affected version, including github.com/traefik/traefik, github.com/traefik/traefik/v2 and github.com/traefik/traefik/v3.

Package	Affected	Fixed in
`github.com/traefik/traefik` Go	All versions	None
`github.com/traefik/traefik` Go	All versions to `1.7.34`	None
`github.com/traefik/traefik` Go	All versions to `1.7.34`	None
`github.com/traefik/traefik/v2` Go	All versions	`2.11.37`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.37`
`github.com/traefik/traefik/v2` Go	All versions	`2.11.37`

3 more packages

`github.com/traefik/traefik/v3` Go	All versions	`3.6.8`
`github.com/traefik/traefik/v3` Go	All versions	`3.6.8`
`github.com/traefik/traefik/v3` Go	All versions	`3.6.8`

How do I fix GHSA-gv8r-9rw9-9697?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is GHSA-gv8r-9rw9-9697 being exploited?

There is no known exploitation of GHSA-gv8r-9rw9-9697 in the wild and no public exploit code.

Sources

Also known as GO-2026-4530.