{"id":"CVE-2026-114637","kind":"vulnerability","aliases":["CVE-2026-114637"],"related":[],"title":"Traefik: experimental FastProxy lets unauthenticated clients reach victim sessions","description":"Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.","summary":"Traefik's experimental FastProxy (experimental.fastProxy, v3.2 to v3.7.13) pools plain-http backend connections without pinning NTLM/Negotiate-authenticated ones to the client's frontend connection. An unauthenticated client on a new connection can be given a backend connection a victim already authenticated on, and is served as that victim. Requires fastProxy enabled, a plain http:// backend using connection-bound NTLM/Negotiate (e.g. IIS Windows auth), and keep-alive. The default proxy is not affected. Traefik v2 is not affected.","severity":"high","cvss":8.7,"epss":0.00299,"exploited":false,"exploited_at":null,"products":[{"name":"traefik","fixed":["3.7.14"],"affected":">= 3.2.0, <= 3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["infrastructure","kerberos","ntlm","reverse-proxy","self-hosted","traefik","windows-auth"],"not_affected_if":["default-config","fastproxy-disabled","https-backends","no-ntlm-backend","no-ntlm-or-negotiate-backends","traefik-v2","versions-outside-3.2.0-3.7.13"],"how_to_check":"Check the static config (traefik.yml/toml, CLI flags or env vars) for experimental.fastProxy (--experimental.fastproxy). If absent, you are not exposed. If present, check whether any service has an http:// backend using NTLM/Negotiate (WWW-Authenticate: NTLM or Negotiate). Run 'traefik version' to see whether it is >= 3.2.0 and < 3.7.14.","fix":"Upgrade to Traefik v3.7.14 or later. v3.2 to v3.6 are unmaintained and get no patch of their own, so move to 3.7.14. Workaround before upgrading: remove experimental.fastProxy from the static config and restart. This is my inference from the advisory saying the default proxy is not affected, and the advisory does not list it as a workaround.","status":"open","published_at":"2026-10-22T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:28+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:35:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Traefik to v3.7.14 or later.\nunknown","reach":"network","title":"Traefik: experimental FastProxy lets unauthenticated clients reach victim sessions","impact":"high","summary":"Traefik's experimental FastProxy connection pool reuses NTLM or Negotiate-authenticated backend connections across clients. An unauthenticated client can be handed a victim's pooled connection and read that victim's data or act as them.","category":"infrastructure","who_cares":["traefik","self-hosted","windows-auth","ntlm"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker reads victim data and acts as the victim","analyst_note":"Confirm how FastProxy is enabled in Traefik config and the exact setting to disable it; check NVD entry for the CVSS vector and any upstream advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["fastproxy-disabled","no-ntlm-or-negotiate-backends","versions-outside-3.2.0-3.7.13"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":2961,"output_tokens":410,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm how FastProxy is enabled in Traefik config and the exact setting to disable it; check NVD entry for the CVSS vector and any upstream advisory.","search":"'-114637':12A,15A '-2026':11A,14A 'act':162C 'affect':102B,107B 'aliv':96B,144C 'alreadi':69B 'auth':29B,92B 'authent':70B,115C 'backend':42B,65B,83B,129C,145C 'bound':87B 'bypass':116C 'client':6A,50B,56B,136C 'complet':150C 'connect':43B,53B,60B,66B,86B,122C,130C,134C,146C 'connection-bound':85B 'contain':113C 'cve':10A,13A 'data':160C 'default':98B 'e.g':89B 'enabl':80B 'experiment':2A,32B,120C 'experimental.fastproxy':34B 'fail':125C 'fastproxi':3A,33B,79B,121C 'frontend':52B,133C 'given':63B 'hand':139C 'handshak':155C 'host':25B 'http':41B 'ii':90B 'infrastructur':17B 'keep':95B,143C 'keep-al':94B,142C 'kerbero':18B 'let':4A,156C 'negoti':154C 'new':59B 'ntlm':19B,152C 'ntlm/negotiate':88B 'ntlm/negotiate-authenticated':46B,128C 'one':47B 'pin':45B,127C 'plain':40B,82B 'plain-http':39B 'pool':38B,123C,141C 'proxi':22B,99B 'reach':7A 'read':158C 'requir':78B 'revers':21B 'reverse-proxi':20B 'self':24B 'self-host':23B 'serv':74B 'session':9A 'traefik':1A,16A,26B,30B,103B,108C 'unauthent':5A,55B,135C 'use':84B 'v2':104B 'v3.2':35B 'v3.2.0':110C 'v3.7.13':37B 'v3.7.14':112C 'victim':8A,68B,77B,149C,159C,165C 'vulner':117C 'window':28B,91B 'windows-auth':27B 'without':44B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114637","severity":null,"published_at":"2026-10-22T02:16:56+00:00","modified_at":"2026-10-22T15:39:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114637:512","url":null,"severity":null,"published_at":"2026-10-23T23:45:21+00:00","modified_at":"2026-10-23T23:45:21+00:00","first_seen_at":"2026-10-23T23:45:21+00:00","fetched_at":"2026-10-23T23:45:21+00:00","note":"Read Traefik GHSA-53qr-784g-cj35 (primary), CVE record, vendor release post. Only affects experimental.fastProxy enabled; default proxy not affected. No exploitation or PoC found; did not search social posts."},{"source":"epss","external_id":"CVE-2026-114637","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114637","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[{"id":2152,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35","title":"Traefik GHSA-53qr-784g-cj35: FastProxy backend connection pool leaks NTLM/Negotiate identity","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2146,"url":"https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-58-and-3-7-3-7-14/30268","title":"Traefik security update 2.11.58 and 3.7.14","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2154,"url":"https://www.cve.org/CVERecord?id=CVE-2026-114637","title":"CVE Record CVE-2026-114637 (CVSS 3.1 8.7, 4.0 7.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}