GHSA-qm9f-w54v-q2qh: Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Q: Who is exposed to this issue?

Deployments running Traefik 2.11.0 through 2.11.57 or 3.0.0 through 3.7.13 are affected when backend connections authenticated with NTLM or Kerberos Negotiate tokens can be reused from Traefik's globally shared backend connection pool.

Q: What does an attacker need to exploit it?

An attacker does not need prior authentication or user interaction. Exploitation depends on a separate request first authenticating a pooled backend socket using an Authorization: Negotiate token; the attacker may then be assigned that socket through a different frontend connection.

Q: What access could an attacker gain?

The attacker can perform backend reads or writes using the identity of the user whose Negotiate-authenticated socket was reused. The described impact affects confidentiality and integrity of the subsequent backend access.

Q: How can this be remediated?

Upgrade Traefik 2.11 deployments to 2.11.58 or later, or Traefik 3 deployments to 3.7.14 or later.

Published Oct 22, 2026

Updated

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

Affected Software

1 affected component

Traefik Labs Traefik>=2.11.0<2.11.58, >=3.0.0<3.7.14

Event History

Oct 22, 2026

CVE Published

via OSV·01:43 AM

Data Sourced

via OSV·01:43 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Traefik 2.11.0 through 2.11.57 or 3.0.0 through 3.7.13 are affected when backend connections authenticated with NTLM or Kerberos Negotiate tokens can be reused from Traefik's globally shared backend connection pool.

What does an attacker need to exploit it?

An attacker does not need prior authentication or user interaction. Exploitation depends on a separate request first authenticating a pooled backend socket using an Authorization: Negotiate token; the attacker may then be assigned that socket through a different frontend connection.

What access could an attacker gain?

The attacker can perform backend reads or writes using the identity of the user whose Negotiate-authenticated socket was reused. The described impact affects confidentiality and integrity of the subsequent backend access.

How can this be remediated?

Upgrade Traefik 2.11 deployments to 2.11.58 or later, or Traefik 3 deployments to 3.7.14 or later.

GHSA-qm9f-w54v-q2qh: Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What access could an attacker gain?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What access could an attacker gain?

How can this be remediated?