Live › vulnerability › CVE-2026-114641
Go to dashboardTraefik 2.11.x before 2.11.58 and 3.x before 3.7.14 read and write a per-connection sticky round tripper slot without locking when handling NTLM or Kerberos (Negotiate) backend authentication. A remote attacker sending concurrent HTTP/2 or HTTP/3 requests over one connection can break connection-bound authentication or crash Traefik.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, since the flawed code path is the backend auth round tripper. Teams that route plain HTTP backends with no NTLM or Kerberos can skip it, though upgrading remains the simple fix.
No product ranges from the sources yet.
traefik version or check the image tag and confirm whether it is below 2.11.58 or below 3.7.14.2.11.58 or later.3.7.14 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
This page as .md · .json · in your agent: get_signal("CVE-2026-114641")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.