{"schema":"threatline.record/2","record":{"id":"GHSA-qm9f-w54v-q2qh","aliases":["GHSA-qm9f-w54v-q2qh"],"summary":"Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool","details":"## Summary\n\nThere is a high severity authentication vulnerability in Traefik's handling of connection-bound backend authentication (NTLM and SPNEGO/Kerberos \"Negotiate\"). For each new frontend connection, Traefik sends the first backend request through a globally shared transport and only switches that connection to an isolated, per-frontend-connection transport *after* it observes an NTLM/Negotiate challenge in the backend's response. When a client preauthenticates — sending a valid `Authorization: Negotiate` token on its first request instead of following the standard challenge-first (`401`) handshake — the backend authenticates the shared-pool connection on that first request and returns a successful response. Because isolation is decided only after the response is seen, the now victim-authenticated backend socket remains in the shared pool, and it is neither drained nor closed. An unrelated, unauthenticated client on a completely separate frontend connection can then be assigned that socket and act with the victim's identity, performing victim-authorized reads or writes.\n\nExploitation requires Traefik to proxy a connection-bound NTLM/Negotiate backend with connection reuse enabled, and a legitimate client that preauthenticates rather than following the standard challenge-first handshake. The ordinary challenge-first flow is not affected: it installs a dedicated backend transport before the credential-bearing request, so the authenticated socket never enters the shared pool. This is a distinct issue from GHSA-qqjf-53cj-pwvv (which fixed a missing HTTP/3 transport holder): it occurs on ordinary HTTP/1.1 and HTTP/2 frontend connections because the credential-bearing first request reaches the shared pool before any holder can isolate it. The behavior was introduced together with connection-bound NTLM/Kerberos support in v2.11.0 and v3.0.0. Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line, and users on those versions must upgrade to v3.7.14.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n","categories":["Unclassified"],"product":"github.com/traefik/traefik/v2","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","source_modified_at":"2026-10-07T08:47:33Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v2"},"range":">= v2.11.0, <= v2.11.57"},{"source":"GitHub Advisory Database","source_url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","source_modified_at":"2026-10-07T08:47:33Z","fetched_at":"2026-10-23T21:14:28.314422Z","package":{"ecosystem":"go","name":"github.com/traefik/traefik/v3"},"range":">= v3.0.0, <= v3.7.13"}],"fixed_versions":[],"cvss":7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T08:47:33Z","modified_at":"2026-10-07T08:47:33Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","fetched_at":"2026-10-23T21:14:28.314422Z","source_modified_at":"2026-10-07T08:47:33Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T08:47:33Z","content_hash":"d0d3e386193d61a1bdc1b53ede0f537f70547d01b79a3880e80d61052a478373"}}