Traefik, the widely used open‑source reverse proxy and load balancer, had an inconsistency in how it processed client‑supplied Connection headers that request a protocol upgrade to HTTP/2 (h2c). When a backend accepts the upgrade and replies with a 101 Switching Protocols, Traefik switches to a raw tunnel mode. In this mode the proxy stops applying any of its routing, authentication, rate‑limiting, logging, metrics, or tracing rules to subsequent HTTP/2 requests. Consequently a client can transit through the proxy to a protected route on a backend that would normally be guarded, effectively bypassing all configured authorisation checks.

Traefik releases from version 2.11.26 through 2.11.57 and the parallel 3.7.13 version are vulnerable. The issue is fixed in Traefik 2.11.57, 3.7.13 and later releases. Verify the exact version in use; if it falls within the affected range, the vulnerability applies.

The CVSS score of 7.0 denotes high severity. The EPSS score is not published, yet the exploit requires only network access and an HTTP request containing a Connection: Upgrade header with the h2c token and an HTTP2‑Settings field. No local privileges are necessary. The vulnerability is not listed in the CISA KEV catalog, but the straightforward attack path and high impact warrant immediate remediation.