---
id: CVE-2022-46153
aliases:
  - GHSA-468w-8x39-gj5v
  - GO-2022-1152
title: Traefik routes exposed with an empty TLSOption
summary: Traefik routes exposed with an empty TLSOption
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
vendor: traefik
product: github.com/traefik/traefik/v2
ecosystem: go
affected:
  - github.com/traefik/traefik/v2 < 2.9.6
patched:
  - github.com/traefik/traefik/v2 2.9.6
published: '2022-12-08'
updated: '2026-08-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-468w-8x39-gj5v'
references:
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-468w-8x39-gj5v'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-46153'
  - url: >-
      https://github.com/traefik/traefik/commit/7e3fe48b80083b41e9ff82a474a36484cabc701a
  - url: 'https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options'
  - url: 'https://github.com/traefik/traefik'
  - url: 'https://github.com/traefik/traefik/releases/tag/v2.9.6'
tags:
  - osv
  - go
epss: 0.00511
epssPercentile: 0.42588
ingestedAt: '2026-08-07T19:14:15.673Z'
---

## Overview

## Impact

There is a potential vulnerability in Traefik managing the TLS connections.

A router configured with a not well-formatted [TLSOption](https://doc.traefik.io/traefik/v2.9/https/tls/#tls-options) is exposed with an empty TLSOption.

For instance, a route secured using an mTLS connection set with a wrong CA file is exposed without verifying the client certificates.

## Patches

https://github.com/traefik/traefik/releases/tag/v2.9.6

## Workarounds

Check the logs to detect the following error messages and fix your TLS options:

- Empty CA:

```
{"level":"error","msg":"invalid clientAuthType: RequireAndVerifyClientCert, CAFiles is required","routerName":"Router0@file"}
```

- Bad CA content (or bad path):

```
{"level":"error","msg":"invalid certificate(s) content","routerName":"Router0@file"}
```

- Unknown Client Auth Type:

```
{"level":"error","msg":"unknown client auth type \"FooClientAuthType\"","routerName":"Router0@file"}
```

- Invalid cipherSuites

```
{"level":"error","msg":"invalid CipherSuite: foobar","routerName":"Router0@file"}
```

- Invalid curvePreferences

```
{"level":"error","msg":"invalid CurveID in curvePreferences: foobar","routerName":"Router0@file"}
``` 

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

## Affected packages

- `github.com/traefik/traefik/v2 < 2.9.6`

## Remediation

Upgrade to a patched release:

- `github.com/traefik/traefik/v2 2.9.6`