{"id":"CVE-2026-114639","kind":"vulnerability","aliases":["CVE-2026-114639"],"related":[],"title":"Traefik: shared backend connection pool lets attackers reuse authenticated sockets","description":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.","summary":"Traefik sends the first backend request of each frontend connection through a shared transport and isolates it only after seeing an NTLM/Negotiate challenge. A client that preauthenticates with Authorization: Negotiate on its first request leaves a victim-authenticated backend socket in the shared pool. An unauthenticated client on another connection can be given that socket and read or write as the victim. It needs a connection-bound NTLM/Negotiate backend with connection reuse enabled, and a client that preauthenticates. The normal challenge-first 401 flow is not affected. Traefik v3.0 to v3.6 are end of life and also affected.","severity":"high","cvss":8.7,"epss":0.00311,"exploited":false,"exploited_at":null,"products":[{"name":"traefik","fixed":["2.11.58"],"affected":">= 2.11.0, < 2.11.58","ecosystem":"go"},{"name":"traefik","fixed":["3.7.14"],"affected":">= 3.0.0, < 3.7.14","ecosystem":"go"}],"ecosystems":["go"],"tags":["infrastructure","kerberos","kubernetes","ntlm","reverse-proxy","self-hosted","traefik"],"not_affected_if":["default-config","managed-hosting","no-ntlm-negotiate-backend"],"how_to_check":"Run 'traefik version' (or check the image tag) and compare with 2.11.0 to 2.11.57 and 3.0.0 to 3.7.13. Then check whether any service proxies to a backend using Kerberos/SPNEGO or NTLM auth (IIS or other Windows-integrated auth). If no backend uses that auth, exposure is unlikely.","fix":"Upgrade 2.11.x to 2.11.58 and 3.x to 3.7.14. Traefik v3.0 to v3.6 get no fix on their own line, so move to 3.7.14. The advisory lists no workaround.","status":"open","published_at":"2026-10-22T02:16:56+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:27+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T22:35:27Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Traefik 2.11.x to 2.11.58 or later, and 3.x to 3.7.14 or later.","reach":"internet","title":"Traefik: shared backend connection pool lets attackers reuse authenticated sockets","impact":"high","summary":"Traefik 2.11.0 to before 2.11.58 and 3.0.0 to before 3.7.14 share one backend connection pool across all clients, and a first request using an Authorization: Negotiate token authenticates a pooled socket. An unauthenticated attacker on another connection can be handed that socket and read or write backend data as the victim.","category":"infrastructure","who_cares":["traefik","self-hosted","kubernetes","ntlm","kerberos"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads or writes backend resources using a victim's authenticated identity.","analyst_note":"Sources do not say which backends or configurations use Negotiate auth; confirm the exposure conditions and check the Traefik release notes for the fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000513,"input_tokens":2971,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources do not say which backends or configurations use Negotiate auth; confirm the exposure conditions and check the Traefik release notes for the fixed versions.","search":"'-114639':13A,16A '-2026':12A,15A '2.11.0':132C '2.11.58':134C '3.0.0':136C '3.7.14':138C '401':115B 'affect':119B,130B 'also':129B 'anoth':79B 'assign':175C 'attack':7A,168C 'authent':9A,68B,141C,153C 'author':58B,150C 'backend':3A,34B,69B,100B,160C 'bound':98B 'bypass':142C 'challeng':52B,113B 'challenge-first':112B 'client':54B,77B,107B 'connect':4A,39B,80B,97B,102B,161C,172C 'connection-bound':96B 'contain':139C 'cve':11A,14A 'enabl':104B 'end':125B 'first':33B,62B,114B,145C 'flow':116B 'frontend':38B,171C 'given':83B 'global':158C 'host':28B 'ident':188C 'infrastructur':19B 'isol':45B,166C 'kerbero':20B 'kubernet':21B 'leav':64B 'let':6A 'life':127B 'need':94B 'negoti':59B,151C 'never':165C 'normal':111B 'ntlm':22B 'ntlm/kerberos-bound':177C 'ntlm/negotiate':51B,99B 'perform':180C 'pool':5A,74B,162C 'preauthent':56B,109B,147C 'proxi':25B 'read':87B,181C 'request':35B,63B,146C 'reus':8A,103B 'revers':24B 'reverse-proxi':23B 'see':49B 'self':27B 'self-host':26B 'send':31B 'separ':170C 'share':2A,42B,73B,159C 'socket':10A,70B,85B,155C,178C 'token':152C 'traefik':1A,17A,18A,29B,30B,120B,131C 'transport':43B 'unauthent':76B,167C 'v3.0':121B 'v3.6':123B 'victim':67B,92B,186C 'victim-authent':66B 'write':89B,183C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114639","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114639","severity":null,"published_at":"2026-10-22T02:16:56+00:00","modified_at":"2026-10-22T15:39:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114639:511","url":null,"severity":null,"published_at":"2026-10-23T23:45:15+00:00","modified_at":"2026-10-23T23:45:15+00:00","first_seen_at":"2026-10-23T23:45:15+00:00","fetched_at":"2026-10-23T23:45:15+00:00","note":"Read Traefik GHSA-qm9f-w54v-q2qh and community release post; X count 0, no discussion. No PoC or exploitation reported. Sibling Traefik NTLM/Negotiate advisories exist (GHSA-qqjf-53cj-pwvv, GHSA-53qr-784g-cj35, GHSA-hrpp-p4fc-wwf8, GHSA-cw35-4q88-3rmp)."},{"source":"epss","external_id":"CVE-2026-114639","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114639","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2145,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","title":"GHSA-qm9f-w54v-q2qh: Preauthenticated Negotiate contaminates Traefik's shared backend pool","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2146,"url":"https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-58-and-3-7-3-7-14/30268","title":"Traefik security update 2.11.58 and 3.7.14","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}