GITHUB.COM/TRAEFIK/TRAEFIK/V3 · GHSA-53qr-784g-cj35 · Infrastructure
FIX → v3.7.14
When experimental FastProxy is enabled, Traefik can reuse a backend connection on which another client completed an NTLM or Negotiate login, so an unauthenticated client on a new connection can be served as that user. An attacker gets the victim's data and can act in the victim's name without credentials.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that enable Traefik's experimental FastProxy, proxy plain HTTP backends that use connection-bound NTLM or Negotiate authentication, and keep backend keep-alive on. The default proxy implementation is not affected, and neither are Traefik v2 or other v3 versions.
Not affected if default-config, https-backends, no-fastproxy, no-ntlm-backends
Who cares kerberos, kubernetes, ntlm, self-hosted, traefik
experimental.fastProxy is enabled in the static Traefik configuration.traefik version; affected versions are 3.2.0 through 3.7.13.http:// backend uses connection-bound NTLM or Negotiate authentication with keep-alive enabled.There is a high severity vulnerability in Traefik's experimental FastProxy implementation. Traefik isolates connection-bound NTLM and Negotiate (Kerberos) backend authentication by pinning the backend connection on which a client authenticated to that client's frontend connection, so that no other client is ever served on it. When experimental.fastProxy is enabled, requests to plain http:// backends are dispatched through FastProxy's own connection pool, which was keyed only by ServersTransport and target URL and did not apply that isolation. Against a backend that binds an identity to a persistent connection, an unauthenticated client on a brand-new frontend connection could be handed a backend connection on which a victim had already completed an NTLM or Negotiate handshake, and be served as that victim, reading victim-only data and performing actions in the victim's name without presenting any credentials. Affected deployments require experimental.fastProxy enabled, a plain HTTP backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive; the default proxy implementation is not affected. FastProxy now dispatches requests carrying an NTLM or Negotiate credential through a connection pool dedicated to their frontend connection, and every subsequent request on that frontend connection to the same backend reuses it.
FastProxy was introduced in Traefik v3.2: v3.2 through v3.6 are affected but are no longer maintained and will not receive a patch of their own, users on those lines must upgrade to v3.7.14. Traefik v2 and earlier v3 versions are not affected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v3.7.14
3.7.14 (v3.2 through v3.6 lines are no longer maintained and will not get a patch; upgrade to 3.7.14).If you have any questions or comments about this advisory, please open an issue.