CVE-2026-114637 in Traefik
Summary
by MITRE • 10/22/2026
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Traefik versions ranging from 3.2.0 up to but not including 3.7.14 represents a critical authentication bypass within the experimental FastProxy connection pool mechanism. This flaw stems from an architectural failure where backend connections established via NTLM or Negotiate protocols are not correctly bound, or pinned, to their corresponding frontend client sessions. In standard reverse proxy operations, it is imperative that each incoming request from a specific client is routed through a dedicated backend session associated with that same client's authentication context. However, in this affected implementation, the connection pool reuses existing keep-alive connections without verifying whether the current requester holds the necessary credentials for that specific pooled resource. This lack of strict association allows an unauthenticated or differently authenticated client to intercept and utilize a backend connection previously established by another user who successfully completed an NTLM or Negotiate handshake.
From a technical perspective, this issue is rooted in how persistent connections are managed within the proxy layer. When a legitimate victim authenticates against a backend service using NTLM or Kerberos via Traefik, the proxy maintains that open TCP connection to avoid the overhead of re-authentication for subsequent requests from that same user. The vulnerability arises because the pool does not enforce strict isolation between these pooled connections and their originating frontend sessions. Consequently, when an unauthenticated attacker sends a request through the same entry point, the load balancing or pooling logic may assign them one of these pre-established backend connections. Since the connection is already authenticated to the backend service on behalf of the victim, the backend server accepts requests from the attacker as if they were coming from the legitimate user. This effectively bypasses the authentication controls at both the proxy and the backend application levels for that specific session duration.
The operational impact of this vulnerability is severe, leading directly to unauthorized data access and potential account takeover scenarios. An unauthenticated adversary can leverage a pooled connection to read sensitive information intended for the victim, such as personal identifiable information, financial records, or proprietary business data stored within the backend application. Furthermore, because the attacker operates under the guise of the authenticated user, they may perform actions on behalf of that user, including modifying settings, initiating transactions, or accessing restricted administrative functions. This breaks the fundamental security principle of identity isolation in multi-tenant environments and compromises the integrity of any system relying on Traefik for secure proxying of NTLM or Negotiate-authenticated services. The risk is particularly acute in enterprise environments where single sign-on protocols are commonly used to streamline access to internal applications, as it allows lateral movement and privilege escalation without requiring credential theft.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically the failure to properly verify user identity before granting access to resources. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it allows an attacker to use valid credentials belonging to another entity without possessing them directly. Additionally, aspects of CWE-359, Exposure of Private Information Within a Log or Database, may be relevant if the pooled connection leads to data leakage. To mitigate this risk, organizations running Traefik versions prior to 3.7.14 should immediately upgrade to version 3.7.14 or later where the connection pinning logic has been corrected. For environments that cannot patch immediately due to operational constraints, disabling the experimental FastProxy feature is a recommended temporary workaround to prevent the exploitation of this specific pooling mechanism. Administrators should also audit their Traefik configurations to ensure no critical services relying on NTLM or Negotiate authentication are exposed through vulnerable proxy instances until the upgrade is complete.