---
id: "CVE-2026-114642"
kind: "vulnerability"
aliases: ["CVE-2026-114642"]
title: "Traefik: NTLM backend slot reuses TLS settings across services"
severity: "high"
cvss: 8.7
epss: 0.00167
exploited: false
status: "open"
category: "runtime"
products: [{"name": "traefik", "fixed": ["2.11.58", "3.7.14"], "affected": ">= 2.11.0, <= 2.11.57; >= 3.0.0, <= 3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["kerberos", "kubernetes", "ntlm", "reverse-proxy", "runtime", "self-hosted", "traefik"]
not_affected_if: ["managed-hosting", "no-ntlm-negotiate-backends", "no-ntlm-or-kerberos-backends", "single-serverstransport", "version-outside-range"]
published_at: "2026-10-22T02:16:57+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114642", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:45:17+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114642", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Traefik: NTLM backend slot reuses TLS settings across services

Traefik keeps its NTLM/Kerberos (Negotiate) backend round tripper in a per-client-connection slot shared by all ServersTransports. A client that triggers an NTLM/Negotiate challenge from one service can then, on the same keep-alive connection, reach another service, whose backend leg is made with the first service's TLS settings: its root CAs, server name and certificate verification are skipped and the first service's client certificate is sent. Needs a backend that issues NTLM/Negotiate challenges and at least two services with different ServersTransports. CVSS 4.0 7.0 / 3.1 8.7.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:traefik affected >= 2.11.0, <= 2.11.57; >= 3.0.0, <= 3.7.13 fixed 2.11.58, 3.7.14

## How to check

Run 'traefik version' (or check the image tag, e.g. kubectl get pods -A -o jsonpath for traefik images): affected if 2.11.0-2.11.57 or 3.0.0-3.7.13. Then see if you are exposed in practice: you route to a backend that answers WWW-Authenticate: NTLM or Negotiate AND have other services using different ServersTransport settings (serversTransport, rootCAs, serverName, insecureSkipVerify, client certs) in your dynamic config/CRDs. Without NTLM/Negotiate backends the trigger is absent. Traefik v1 and v2 before 2.11.0 are not affected.

## Fix

Upgrade Traefik 2.x to 2.11.58, or 3.x to 3.7.14. Traefik 3.0-3.6 no longer get patches; move to 3.7.14. No official workaround in the advisory; until upgraded, avoid mixing NTLM/Negotiate backends with services that rely on different ServersTransport TLS policies behind the same entrypoint.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114642
- 2026-10-23T23:45:17+00:00 analyst — Read Traefik GHSA-cw35-4q88-3rmp (primary); release page linked but not read, versions from advisory. No X chatter, no PoC or exploitation reported. No workaround stated in advisory (inferred mitigation only). Sibling Traefik NTLM advisories fixed in same releases: GHSA-qm9f-w54v-q2qh, GHSA-53qr-784g-cj35; CVE-2026-114641 (race) is adjacent.
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114642

## Documents

- [advisory] Traefik GHSA-cw35-4q88-3rmp: sticky round tripper not keyed by service https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp
- [fix] Traefik v3.7.14 release https://github.com/traefik/traefik/releases/tag/v3.7.14

## From the sources

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_