CVE-2026-114639GHSA-qm9f-w54v-q2qh
Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
traefik traefik
CVSS
7.0HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.31%Chance of exploitation activity in the next 30 days, higher than 22% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
Text from CVE List
Affected versions 4
- traefikaffected: 2.11.0 before 2.11.58CVE List
- traefikunaffected: 2.11.58CVE List
- traefikaffected: 3.0.0 before 3.7.14CVE List
- traefikunaffected: 3.7.14CVE List