CVE-2024-39321: Traefik Auth Bypass Vulnerability

CVE-2024-39321 Overview

CVE-2024-39321 is a high-severity authorization bypass vulnerability in Traefik, an HTTP reverse proxy and load balancer widely deployed for microservices and container ingress. The flaw allows attackers to bypass IP allow-list middleware by sending HTTP/3 early data requests during QUIC 0-RTT handshakes with spoofed source IP addresses. The issue affects Traefik versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3, and is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key). The vendor released patches in those versions, and no workarounds are available.

Critical Impact
Attackers can bypass IP-based access controls protecting internal services, dashboards, and APIs by spoofing trusted IPs over QUIC 0-RTT, undermining a core perimeter control.

Affected Products

Traefik versions prior to 2.11.6
Traefik 3.x versions prior to 3.0.4
Traefik 3.1.0, 3.1.0-rc1, and 3.1.0-rc2

Discovery Timeline

2024-07-05 - CVE-2024-39321 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39321

Vulnerability Analysis

Traefik supports HTTP/3 over QUIC, which permits clients to send application data during the initial handshake using 0-RTT (zero round-trip time) resumption. In affected versions, Traefik processes this early data and evaluates IP allow-list middleware against the source address presented in the QUIC packet. Because QUIC 0-RTT does not complete a return-path validation before the server processes early data, an attacker can spoof the source IP and have the request honored as if it originated from a trusted address. This converts an IP-based access control into a trivially bypassable check.

Root Cause

The root cause is the use of an attacker-controllable identifier (the QUIC packet source IP) as the authorization key without first validating the peer over a completed handshake. The IP allow-list middleware compares the spoofable source IP against the configured allow-list, satisfying [CWE-639] semantics. HTTP/3 0-RTT handshakes are inherently susceptible to source-address spoofing until path validation completes, so any control derived from the apparent client address before validation is unreliable.

Attack Vector

The attack is fully remote, requires no authentication, and no user interaction. An attacker crafts QUIC Initial packets with a spoofed source IP matching an entry in the target's IPAllowList middleware and embeds an HTTP/3 request as 0-RTT early data. Traefik routes the early-data request through the middleware, which approves it based on the spoofed address, granting access to backends intended to be reachable only from trusted networks. Replies are returned to the spoofed source and are not required for the attacker to achieve the integrity impact.

No public proof-of-concept code is referenced in the advisory. For protocol-level details, consult the Traefik security advisory GHSA-gxrv-wf35-62w9.

Detection Methods for CVE-2024-39321

Indicators of Compromise

HTTP/3 (UDP/443 or configured QUIC port) requests to administrative endpoints, dashboards, or APIs that should be reachable only from allow-listed networks.
Access log entries showing requests sourced from allow-listed CIDRs but lacking corresponding outbound traffic patterns or session continuity from those hosts.
QUIC 0-RTT early-data requests immediately followed by failed or absent handshake completion telemetry.

Detection Strategies

Inventory Traefik deployments and identify any instance running a version prior to 2.11.6, 3.0.4, or 3.1.0-rc3 with HTTP/3 enabled (--entryPoints.<name>.http3).
Correlate Traefik access logs with network flow data to identify requests that claim trusted source IPs but do not appear in upstream firewall or flow records.
Alert on any HTTP/3 traffic reaching IP-restricted routes; legitimate internal callers typically use HTTP/1.1 or HTTP/2.

Monitoring Recommendations

Enable verbose Traefik access logging including the entry point and protocol, and forward logs to a centralized analytics platform for retrospective hunting.
Monitor for unexpected QUIC traffic volume to Traefik entry points and baseline normal HTTP/3 client populations.
Track invocation counts of IPAllowList middleware decisions and review approvals against expected source networks.

How to Mitigate CVE-2024-39321

Immediate Actions Required

Upgrade Traefik to 2.11.6, 3.0.4, or 3.1.0-rc3 or later as soon as possible.
If patching is not immediately feasible, disable HTTP/3 entry points until the upgrade can be completed.
Audit all routers and middlewares that rely on IPAllowList or ipWhiteList and assume those controls were bypassable on vulnerable versions.
Review access logs since HTTP/3 was enabled for suspicious requests against IP-restricted routes.

Patch Information

The Traefik maintainers fixed CVE-2024-39321 in Traefik v2.11.6, Traefik v3.0.4, and Traefik v3.1.0-rc3. The patched releases prevent the IP allow-list middleware from honoring source addresses derived from unvalidated QUIC 0-RTT early data. Refer to GitHub Security Advisory GHSA-gxrv-wf35-62w9 for the full advisory.

Workarounds

No vendor-supplied workarounds are available; upgrading is required.
As a compensating control, disable HTTP/3 on Traefik entry points by removing the http3 block from the affected entry point configuration.
Enforce IP restrictions at an upstream network device (firewall, cloud security group, or service mesh) that does not rely on QUIC 0-RTT client addresses.

bash

# Compensating control: disable HTTP/3 on the websecure entry point
# (static configuration, traefik.yml)
entryPoints:
  websecure:
    address: ":443"
    # Remove or comment out the http3 section until patched
    # http3:
    #   advertisedPort: 443