Live › vulnerability › CVE-2026-114637
Go to dashboardTraefik's experimental FastProxy (experimental.fastProxy, v3.2 to v3.7.13) pools plain-http backend connections without pinning NTLM/Negotiate-authenticated ones to the client's frontend connection. An unauthenticated client on a new connection can be given a backend connection a victim already authenticated on, and is served as that victim. Requires fastProxy enabled, a plain http:// backend using connection-bound NTLM/Negotiate (e.g. IIS Windows auth), and keep-alive. The default proxy is not affected. Traefik v2 is not affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| traefik | go | >= 3.2.0, <= 3.7.13 | 3.7.14 |
traefik version to see whether it is >= 3.2.0 and < 3.7.14v3.7.14 or later. v3.2 to v3.6 are unmaintained and get no patch of their own, so move to 3.7.14Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.
This page as .md · .json · in your agent: get_signal("CVE-2026-114637")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.