{"id":"CVE-2026-114641","kind":"vulnerability","aliases":["CVE-2026-114641"],"related":[],"title":"Traefik: race in NTLM and Kerberos backend auth lets remote requests crash it","description":"Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.","summary":"Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 read and write a per-connection sticky round tripper slot without locking when handling NTLM or Kerberos (Negotiate) backend authentication. A remote attacker sending concurrent HTTP/2 or HTTP/3 requests over one connection can break connection-bound authentication or crash Traefik.","severity":"medium","cvss":6.3,"epss":0.00256,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","runtime","self-hosted","traefik","windows-backends"],"not_affected_if":["default-config","no-ntlm-or-kerberos-backends"],"how_to_check":"- Run `traefik version` or check the image tag and confirm whether it is below `2.11.58` or below `3.7.14`.\n- Check whether any router forwards to a backend using NTLM or Negotiate (Kerberos) authentication.","fix":"- Upgrade Traefik 2.11.x to `2.11.58` or later.\n- Upgrade Traefik 3.x to `3.7.14` or later.","status":"open","published_at":"2026-10-22T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:01:20+00:00","updated_at":"2026-10-25T04:01:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T04:01:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Traefik 2.11.x to `2.11.58` or later.\n- Upgrade Traefik 3.x to `3.7.14` or later.","reach":"internet","title":"Traefik: race in NTLM and Kerberos backend auth lets remote requests crash it","impact":"medium","summary":"Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 read and write a per-connection sticky round tripper slot without locking when handling NTLM or Kerberos (Negotiate) backend authentication. A remote attacker sending concurrent HTTP/2 or HTTP/3 requests over one connection can break connection-bound authentication or crash Traefik.","category":"runtime","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","windows-backends"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote requests crash Traefik or break backend authentication sessions","analyst_note":"","how_to_check":"- Run `traefik version` or check the image tag and confirm whether it is below `2.11.58` or below `3.7.14`.\n- Check whether any router forwards to a backend using NTLM or Negotiate (Kerberos) authentication.","needs_analyst":false,"not_affected_if":["no-ntlm-or-kerberos-backends","default-config"],"who_is_affected":"Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, since the flawed code path is the backend auth round tripper. Teams that route plain HTTP backends with no NTLM or Kerberos can skip it, though upgrading remains the simple fix.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3422,"output_tokens":613,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114641':15A,18A '-2026':14A,17A '2.11':29B,81C '2.11.58':32B,84C '3':34B,86C '3.7.14':37B,89C 'attack':61B,117C 'auth':8A 'authent':58B,76B,100C,136C 'backend':7A,27B,57B,99C,130C 'bound':75B,135C 'break':72B,132C 'concurr':63B,120C 'condit':93C 'connect':44B,70B,74B,105C,127C,131C,134C 'connection-bound':73B,133C 'contain':90C 'crash':12A,78B,138C 'cve':13A,16A 'handl':52B 'host':23B 'http/2':64B,121C 'http/3':66B,123C 'kerbero':6A,55B,97C 'kubernet':19B 'let':9A 'lock':50B 'negoti':56B,98C 'ntlm':4A,53B,95C 'one':69B,126C 'orphan':129C 'per':43B,104C 'per-connect':42B,103C 'race':2A,92C 'read':38B,111C 'remot':10A,60B,116C 'request':11A,67B,124C 'round':46B,107C 'runtim':20B 'self':22B 'self-host':21B 'send':62B,119C 'slot':48B,109C 'sticki':45B,106C 'synchron':115C 'traefik':1A,24B,28B,79B,80C,139C 'tripper':47B,108C 'window':26B 'windows-backend':25B 'without':49B,114C 'write':40B 'written':113C 'x':30B,35B,82C,87C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, since the flawed code path is the backend auth round tripper. Teams that route plain HTTP backends with no NTLM or Kerberos can skip it, though upgrading remains the simple fix.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114641","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114641","severity":null,"published_at":"2026-10-22T02:16:57+00:00","modified_at":"2026-10-22T15:39:30+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114641","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114641","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}