Traefik: shared backend connection pool lets attackers reuse authenticated sockets

Traefik sends the first backend request of each frontend connection through a shared transport and isolates it only after seeing an NTLM/Negotiate challenge. A client that preauthenticates with Authorization: Negotiate on its first request leaves a victim-authenticated backend socket in the shared pool. An unauthenticated client on another connection can be given that socket and read or write as the victim. It needs a connection-bound NTLM/Negotiate backend with connection reuse enabled, and a client that preauthenticates. The normal challenge-first 401 flow is not affected. Traefik v3.0 to v3.6 are end of life and also affected.

Summary written from the sources below. Check the originals before acting.