{"id":"CVE-2026-114642","kind":"vulnerability","aliases":["CVE-2026-114642"],"related":[],"title":"Traefik: NTLM backend slot reuses TLS settings across services","description":"Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.","summary":"Traefik keeps its NTLM/Kerberos (Negotiate) backend round tripper in a per-client-connection slot shared by all ServersTransports. A client that triggers an NTLM/Negotiate challenge from one service can then, on the same keep-alive connection, reach another service, whose backend leg is made with the first service's TLS settings: its root CAs, server name and certificate verification are skipped and the first service's client certificate is sent. Needs a backend that issues NTLM/Negotiate challenges and at least two services with different ServersTransports. CVSS 4.0 7.0 / 3.1 8.7.","severity":"high","cvss":8.7,"epss":0.00167,"exploited":false,"exploited_at":null,"products":[{"name":"traefik","fixed":["2.11.58","3.7.14"],"affected":">= 2.11.0, <= 2.11.57; >= 3.0.0, <= 3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["kerberos","kubernetes","ntlm","reverse-proxy","runtime","self-hosted","traefik"],"not_affected_if":["managed-hosting","no-ntlm-negotiate-backends","no-ntlm-or-kerberos-backends","single-serverstransport","version-outside-range"],"how_to_check":"Run 'traefik version' (or check the image tag, e.g. kubectl get pods -A -o jsonpath for traefik images): affected if 2.11.0-2.11.57 or 3.0.0-3.7.13. Then see if you are exposed in practice: you route to a backend that answers WWW-Authenticate: NTLM or Negotiate AND have other services using different ServersTransport settings (serversTransport, rootCAs, serverName, insecureSkipVerify, client certs) in your dynamic config/CRDs. Without NTLM/Negotiate backends the trigger is absent. Traefik v1 and v2 before 2.11.0 are not affected.","fix":"Upgrade Traefik 2.x to 2.11.58, or 3.x to 3.7.14. Traefik 3.0-3.6 no longer get patches; move to 3.7.14. No official workaround in the advisory; until upgraded, avoid mixing NTLM/Negotiate backends with services that rely on different ServersTransport TLS policies behind the same entrypoint.","status":"open","published_at":"2026-10-22T02:16:57+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:35:26+00:00","updated_at":"2026-10-24T07:15:52+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:35:26Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Traefik 2.x to 2.11.58 or later, or 3.x to 3.7.14 or later.","reach":"internet","title":"Traefik: NTLM backend slot reuses TLS settings across services","impact":"medium","summary":"Traefik can send a request to one backend using another service's TLS client settings, so certificate checks for that backend are skipped. An unauthenticated client can reach a different service on the same keep-alive connection after triggering an NTLM or Negotiate challenge.","category":"runtime","who_cares":["traefik","self-hosted","kubernetes"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reaches an internal backend while bypassing its certificate verification","analyst_note":"Check the NVD entry and the Traefik release notes for the exact trigger config (NTLM or Negotiate auth on a ServersTransport) and any workaround for versions that cannot upgrade.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-outside-range","no-ntlm-or-kerberos-backends"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000507,"input_tokens":2997,"output_tokens":415,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Traefik release notes for the exact trigger config (NTLM or Negotiate auth on a ServersTransport) and any workaround for versions that cannot upgrade.","search":"'-114642':12A,15A '-2026':11A,14A '2.11.0':121C '2.11.58':123C '3.0.0':125C '3.1':118B '3.7.14':127C '4.0':116B '7.0':117B '8.7':119B 'across':8A 'aliv':64B,183C 'anoth':67B,154C,176C 'arm':162C 'backend':3A,33B,70B,102B,131C,157C,167C 'bypass':185C 'cas':83B,188C 'certif':87B,97B,192C 'challeng':53B,106B,173C 'client':40B,48B,96B,137C,149C,160C 'client-connect':136C 'configur':150C 'connect':41B,65B,138C,184C 'cve':10A,13A 'cvss':115B 'differ':113B 'first':76B,93B 'host':26B 'issu':104B,168C 'keep':29B,63B,182C 'keep-al':62B,181C 'kerbero':17B 'key':141C 'kubernet':18B 'least':109B 'leg':71B 'made':73B 'name':85B,190C 'need':100B 'negoti':32B,172C 'ntlm':2A,19B,170C 'ntlm/kerberos':31B,130C 'ntlm/negotiate':52B,105B 'one':55B,145C 'per':39B 'per-client-connect':38B 'proxi':22B 'reach':66B,175C 'reus':5A,152C 'revers':21B 'reverse-proxi':20B 'root':82B,187C 'round':34B,132C 'runtim':23B 'self':25B 'self-host':24B 'sent':99B 'server':84B,189C 'serverstransport':46B,114B,143C 'servic':9A,56B,68B,77B,94B,111B,146C,155C,177C 'set':7A,80B 'share':43B 'skip':90B 'slot':4A,42B,139C,164C 'store':128C 'tls':6A,79B,148C 'traefik':1A,16A,27B,28B,120C 'trigger':50B 'tripper':35B,133C 'two':110B 'unauthent':159C 'verif':88B,193C 'via':165C 'whose':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114642","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114642","severity":null,"published_at":"2026-10-22T02:16:57+00:00","modified_at":"2026-10-23T15:17:27+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-114642:510","url":null,"severity":null,"published_at":"2026-10-23T23:45:17+00:00","modified_at":"2026-10-23T23:45:17+00:00","first_seen_at":"2026-10-23T23:45:17+00:00","fetched_at":"2026-10-23T23:45:17+00:00","note":"Read Traefik GHSA-cw35-4q88-3rmp (primary); release page linked but not read, versions from advisory. No X chatter, no PoC or exploitation reported. No workaround stated in advisory (inferred mitigation only). Sibling Traefik NTLM advisories fixed in same releases: GHSA-qm9f-w54v-q2qh, GHSA-53qr-784g-cj35; CVE-2026-114641 (race) is adjacent."},{"source":"epss","external_id":"CVE-2026-114642","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114642","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":2147,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp","title":"Traefik GHSA-cw35-4q88-3rmp: sticky round tripper not keyed by service","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2148,"url":"https://github.com/traefik/traefik/releases/tag/v3.7.14","title":"Traefik v3.7.14 release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}