CVE-2026-114642 in Traefik
Summary
by MITRE • 10/22/2026
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in Traefik versions prior to 2.11.58 and 3.7.14 represents a critical flaw in how the reverse proxy manages backend connections for authentication protocols such as NTLM and Kerberos. Specifically, the issue resides within the round tripper mechanism responsible for handling these complex authentication handshakes. When Traefik interacts with backends requiring NTLM or Negotiate authentication, it establishes a persistent connection to maintain state across multiple HTTP requests involved in the challenge-response sequence. However, the implementation fails to properly key this client-connection slot by the ServersTransport configuration object. Instead of ensuring that each distinct backend service utilizes its own isolated transport and TLS context, the system allows connections to be shared or misaligned based on how they are stored in internal connection pools. This architectural oversight means that the specific TLS settings defined for one service can inadvertently apply to requests directed at a completely different service if they happen to share underlying network resources or connection slots during the authentication phase.
The operational impact of this flaw is severe, as it effectively bypasses fundamental Transport Layer Security (TLS) verification mechanisms. An unauthenticated attacker who has access to any backend that issues an NTLM or Negotiate challenge can exploit this state leakage. By initiating a request to such a vulnerable service, the attacker triggers the creation of a connection slot associated with their controlled environment. Subsequently, by sending requests for other services on the same keep-alive TCP connection, the attacker forces Traefik to reuse that compromised connection context. Consequently, the TLS client configuration intended for the target service is replaced or overridden by the settings from the initial backend. This allows the attacker to bypass root Certificate Authority (CA) verification, ignore Server Name Indication (SNI) checks, and disregard certificate validation entirely. The result is a complete failure of mutual authentication and identity assurance between Traefik and its upstream services.
From a security classification perspective, this vulnerability aligns with CWE-295 Improper Certificate Validation, as the system fails to correctly validate certificates against trusted authorities due to configuration leakage. It also relates to CWE-613 Insufficient Session Expiration, given that persistent connections are reused inappropriately across different logical contexts. In terms of attack vectors and techniques, this behavior is consistent with ATT&CK technique T1078 Valid Accounts or more broadly T1552 Unsecured Credentials if the misconfiguration leads to credential exposure, but primarily it falls under privilege escalation through configuration manipulation akin to CWE-94 Improper Control of Generation of Code. The ability to bypass TLS verification effectively neutralizes the security guarantees provided by HTTPS, allowing for potential man-in-the-middle attacks or unauthorized access to internal services that rely on strict certificate pinning and validation.
Mitigation requires an immediate upgrade to Traefik version 2.11.58 or later if operating in the v2 series, or version 3.7.14 and later for the v3 series. These releases contain patches that correctly key the backend round tripper connections by their respective ServersTransport configurations, ensuring strict isolation of TLS contexts between different services. Until an upgrade is feasible, administrators should consider network-level segmentation to limit exposure to backends requiring NTLM or Kerberos authentication, although this is a less robust defense than applying the vendor patch. Additionally, reviewing Traefik configuration files for any custom transport settings that might interact with these legacy connection pools can help identify potential attack surfaces in complex deployments where multiple services share infrastructure resources.