CVE-2026-114637: Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Traefik versions from v3.2.0 before v3.7.14 are affected when they use the experimental FastProxy connection pool with backends that authenticate clients using NTLM or Negotiate.
What does an attacker need to exploit this?
An attacker does not need prior authentication or user interaction. They must be able to send requests through the affected Traefik instance and receive a pooled keep-alive backend connection previously authenticated by a victim.
What is the impact if exploitation succeeds?
The attacker may read data belonging to the victim whose backend authentication was reused and perform actions as that victim. The issue affects confidentiality and integrity, but no availability impact is stated.
What mitigation is indicated if an immediate upgrade is not possible?
The provided information identifies the experimental FastProxy connection pool and NTLM/Negotiate backend authentication as the affected conditions. Reducing or removing those conditions would limit exposure, but no specific vendor-supported workaround is provided in the data.