---
id: "CVE-2026-114637"
kind: "vulnerability"
aliases: ["CVE-2026-114637"]
title: "Traefik: experimental FastProxy lets unauthenticated clients reach victim sessions"
severity: "high"
cvss: 8.7
epss: 0.00299
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "traefik", "fixed": ["3.7.14"], "affected": ">= 3.2.0, <= 3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["infrastructure", "kerberos", "ntlm", "reverse-proxy", "self-hosted", "traefik", "windows-auth"]
not_affected_if: ["default-config", "fastproxy-disabled", "https-backends", "no-ntlm-backend", "no-ntlm-or-negotiate-backends", "traefik-v2", "versions-outside-3.2.0-3.7.13"]
published_at: "2026-10-22T02:16:56+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114637", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:45:21+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114637", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Traefik: experimental FastProxy lets unauthenticated clients reach victim sessions

Traefik's experimental FastProxy (experimental.fastProxy, v3.2 to v3.7.13) pools plain-http backend connections without pinning NTLM/Negotiate-authenticated ones to the client's frontend connection. An unauthenticated client on a new connection can be given a backend connection a victim already authenticated on, and is served as that victim. Requires fastProxy enabled, a plain http:// backend using connection-bound NTLM/Negotiate (e.g. IIS Windows auth), and keep-alive. The default proxy is not affected. Traefik v2 is not affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:traefik affected >= 3.2.0, <= 3.7.13 fixed 3.7.14

## How to check

Check the static config (traefik.yml/toml, CLI flags or env vars) for experimental.fastProxy (--experimental.fastproxy). If absent, you are not exposed. If present, check whether any service has an http:// backend using NTLM/Negotiate (WWW-Authenticate: NTLM or Negotiate). Run 'traefik version' to see whether it is >= 3.2.0 and < 3.7.14.

## Fix

Upgrade to Traefik v3.7.14 or later. v3.2 to v3.6 are unmaintained and get no patch of their own, so move to 3.7.14. Workaround before upgrading: remove experimental.fastProxy from the static config and restart. This is my inference from the advisory saying the default proxy is not affected, and the advisory does not list it as a workaround.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114637
- 2026-10-23T23:45:21+00:00 analyst — Read Traefik GHSA-53qr-784g-cj35 (primary), CVE record, vendor release post. Only affects experimental.fastProxy enabled; default proxy not affected. No exploitation or PoC found; did not search social posts.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114637

## Documents

- [advisory] Traefik GHSA-53qr-784g-cj35: FastProxy backend connection pool leaks NTLM/Negotiate identity https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35
- [describes] CVE Record CVE-2026-114637 (CVSS 3.1 8.7, 4.0 7.0) https://www.cve.org/CVERecord?id=CVE-2026-114637
- [fix] Traefik security update 2.11.58 and 3.7.14 https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-58-and-3-7-3-7-14/30268

## From the sources

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_