Live › vulnerability › CVE-2026-114642
Go to dashboardTraefik keeps its NTLM/Kerberos (Negotiate) backend round tripper in a per-client-connection slot shared by all ServersTransports. A client that triggers an NTLM/Negotiate challenge from one service can then, on the same keep-alive connection, reach another service, whose backend leg is made with the first service's TLS settings: its root CAs, server name and certificate verification are skipped and the first service's client certificate is sent. Needs a backend that issues NTLM/Negotiate challenges and at least two services with different ServersTransports. CVSS 4.0 7.0 / 3.1 8.7.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| traefik | go | >= 2.11.0, <= 2.11.57; >= 3.0.0, <= 3.7.13 | 2.11.58, 3.7.14 |
traefik version (or check the image tag, e.g. kubectl get pods -A -o jsonpath for traefik images): affected if 2.11.0-2.11.57 or 3.0.0-3.7.132.11.0 are not affected2.11.58, or 3.x to 3.7.143.7.14Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.
This page as .md · .json · in your agent: get_signal("CVE-2026-114642")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.