CVE-2026-114639: Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Traefik deployments running versions 2.11.0 through before 2.11.58, or 3.0.0 through before 3.7.14, are affected when backend connections authenticated with Authorization: Negotiate can be placed in the globally shared connection pool.
What does an attacker need to exploit this issue?
An attacker does not need credentials or user interaction. Exploitation requires a previously authenticated request using an NTLM or Kerberos Negotiate token so that its backend socket is available for reassignment to the attacker’s separate frontend connection.
What access could an attacker obtain?
If assigned the victim-bound backend socket, an unauthenticated attacker can perform backend reads or writes using the identity of the user whose Negotiate authentication originally authenticated that connection.