CVE-2026-88007: Traefik HTTP/3 Backend NTLM Connection Reuse

Q: Which deployments are exposed to cross-client authentication reuse?

Exposure requires all of the following: an affected Traefik release, an HTTP/3 entrypoint enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive enabled. Deployments without these conditions are not described as affected.

Q: What must an attacker do to exploit this issue?

An unrelated client must cause Traefik to reuse a backend connection that was previously authenticated for a victim. The attacker does not need the victim's credentials and may then read data available to the victim or act as that victim.

Q: What can be done if updating Traefik cannot happen immediately?

Disable HTTP/3 on the affected entrypoint, disable backend keep-alive, or avoid backends using connection-bound NTLM or Negotiate authentication. These measures remove one or more conditions required for the described exposure.

Q: Which versions contain the fix?

The issue is fixed in Traefik 2.11.57 and 3.7.13. Affected releases are stated as versions from 2.11.0 until 2.11.57, and 3.7.13.

Published Sep 10, 2026

Updated

Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.

Affected Software

2 affected components

Traefik traefik>=2.11.0<2.11.57

Traefik traefik=3.7.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Traefik to a version that resolves this vulnerability.
Fixed in 2.11.57
Upgrade
Upgrade Traefik to a version that resolves this vulnerability.
Fixed in 3.7.13

Event History

Sep 10, 2026

CVE Published

via MITRE·02:47 PM

Data Sourced

via MITRE·02:47 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to cross-client authentication reuse?

Exposure requires all of the following: an affected Traefik release, an HTTP/3 entrypoint enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive enabled. Deployments without these conditions are not described as affected.

What must an attacker do to exploit this issue?