{"id":"CVE-2022-46153","aliases":["GHSA-468w-8x39-gj5v","GO-2022-1152"],"title":"Traefik routes exposed with an empty TLSOption","summary":"Traefik routes exposed with an empty TLSOption","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"traefik","product":"github.com/traefik/traefik/v2","ecosystem":"go","affected":["github.com/traefik/traefik/v2 < 2.9.6"],"patched":["github.com/traefik/traefik/v2 2.9.6"],"published":"2022-12-08","updated":"2026-08-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-468w-8x39-gj5v","references":[{"url":"https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46153"},{"url":"https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a"},{"url":"https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options"},{"url":"https://github.com/traefik/traefik"},{"url":"https://github.com/traefik/traefik/releases/tag/v2.9.6"}],"tags":["osv","go"],"epss":0.00511,"epssPercentile":0.42562,"ingestedAt":"2026-08-07T19:14:15.673Z","slug":"CVE-2022-46153","body":"## Overview\n\n## Impact\n\nThere is a potential vulnerability in Traefik managing the TLS connections.\n\nA router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.\n\nFor instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.\n\n## Patches\n\nhttps://github.com/traefik/traefik/releases/tag/v2.9.6\n\n## Workarounds\n\nCheck the logs to detect the following error messages and fix your TLS options:\n\n- Empty CA:\n\n```\n{\"level\":\"error\",\"msg\":\"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required\",\"routerName\":\"Router0@file\"}\n```\n\n- Bad CA content (or bad path):\n\n```\n{\"level\":\"error\",\"msg\":\"invalid certificate(s) content\",\"routerName\":\"Router0@file\"}\n```\n\n- Unknown Client Auth Type:\n\n```\n{\"level\":\"error\",\"msg\":\"unknown client auth type \\\"FooClientAuthType\\\"\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid cipherSuites\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CipherSuite: foobar\",\"routerName\":\"Router0@file\"}\n```\n\n- Invalid curvePreferences\n\n```\n{\"level\":\"error\",\"msg\":\"invalid CurveID in curvePreferences: foobar\",\"routerName\":\"Router0@file\"}\n``` \n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n## Affected packages\n\n- `github.com/traefik/traefik/v2 < 2.9.6`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/traefik/traefik/v2 2.9.6`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}