CVE-2026-114642: Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Q: Which deployments are exposed to this issue?

Traefik deployments running versions 2.11.0 through 2.11.57 or 3.0.0 through 3.7.13 are affected when backend NTLM or Kerberos/Negotiate authentication can cause the shared round tripper to be used. The issue involves services reached over the same client keep-alive connection.

Q: What does an attacker need to do to exploit the bypass?

The attacker does not need authentication or user interaction. They must first cause a backend to issue an NTLM or Negotiate challenge, which arms the stored round tripper, then access another service over the same keep-alive connection.

Q: What TLS protections can be bypassed?

A service may receive the TLS client configuration previously used for a different service rather than its own ServersTransport configuration. This can bypass the affected service's configured root CAs, server name, and certificate verification.

Q: How can I determine whether my Traefik instance needs remediation?

Check whether Traefik is in the affected version ranges and whether it routes to backends that use or can issue NTLM or Negotiate challenges. Also assess whether multiple services with distinct ServersTransport TLS settings can be reached through the same keep-alive connection.

Published Oct 22, 2026

Updated

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

Affected Software

1 affected component

Traefik traefik>=2.11.0<2.11.58, >=3.0.0<3.7.14

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Traefik to a version that resolves this vulnerability.
Fixed in 2.11.58
Upgrade
Upgrade Traefik to a version that resolves this vulnerability.
Fixed in 3.7.14

Event History

Oct 22, 2026

CVE Published

via MITRE·01:43 AM

Data Sourced

via MITRE·01:43 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Traefik deployments running versions 2.11.0 through 2.11.57 or 3.0.0 through 3.7.13 are affected when backend NTLM or Kerberos/Negotiate authentication can cause the shared round tripper to be used. The issue involves services reached over the same client keep-alive connection.

What does an attacker need to do to exploit the bypass?

The attacker does not need authentication or user interaction. They must first cause a backend to issue an NTLM or Negotiate challenge, which arms the stored round tripper, then access another service over the same keep-alive connection.

What TLS protections can be bypassed?

A service may receive the TLS client configuration previously used for a different service rather than its own ServersTransport configuration. This can bypass the affected service's configured root CAs, server name, and certificate verification.

How can I determine whether my Traefik instance needs remediation?

Check whether Traefik is in the affected version ranges and whether it routes to backends that use or can issue NTLM or Negotiate challenges. Also assess whether multiple services with distinct ServersTransport TLS settings can be reached through the same keep-alive connection.

CVE-2026-114642: Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the bypass?

What TLS protections can be bypassed?

How can I determine whether my Traefik instance needs remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit the bypass?

What TLS protections can be bypassed?

How can I determine whether my Traefik instance needs remediation?