{"id":"GHSA-53qr-784g-cj35","kind":"vulnerability","aliases":["GHSA-53qr-784g-cj35"],"related":[],"title":"FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's experimental FastProxy implementation. Traefik isolates connection-bound NTLM and Negotiate (Kerberos) backend authentication by pinning the backend connection on which a client authenticated to that client's frontend connection, so that no other client is ever served on it. When `experimental.fastProxy` is enabled, requests to plain `http://` backends are dispatched through FastProxy's own connection pool, which was keyed only by ServersTransport and target URL and did not apply that isolation. Against a backend that binds an identity to a persistent connection, an unauthenticated client on a brand-new frontend connection could be handed a backend connection on which a victim had already completed an NTLM or Negotiate handshake, and be served as that victim, reading victim-only data and performing actions in the victim's name without presenting any credentials. Affected deployments require `experimental.fastProxy` enabled, a plain HTTP backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive; the default proxy implementation is not affected. FastProxy now dispatches requests carrying an NTLM or Negotiate credential through a connection pool dedicated to their frontend connection, and every subsequent request on that frontend connection to the same backend reuses it.\n\nFastProxy was introduced in Traefik v3.2: v3.2 through v3.6 are affected but are no longer maintained and will not receive a patch of their own, users on those lines must upgrade to v3.7.14. Traefik v2 and earlier v3 versions are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"When experimental FastProxy is enabled, Traefik can reuse a backend connection on which another client completed an NTLM or Negotiate login, so an unauthenticated client on a new connection can be served as that user. An attacker gets the victim's data and can act in the victim's name without credentials.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.2.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-488","infrastructure","kerberos","kubernetes","ntlm","self-hosted","traefik"],"not_affected_if":["default-config","https-backends","no-fastproxy","no-ntlm-backends"],"how_to_check":"- Check whether `experimental.fastProxy` is enabled in the static Traefik configuration.\n- Check the Traefik version with `traefik version`; affected versions are `3.2.0` through `3.7.13`.\n- Check whether any plain `http://` backend uses connection-bound NTLM or Negotiate authentication with keep-alive enabled.","fix":"- Traefik `3.7.14` (v3.2 through v3.6 lines are no longer maintained and will not get a patch; upgrade to `3.7.14`).","status":"open","published_at":"2026-10-07T08:47:35+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:28+00:00","updated_at":"2026-11-09T23:00:28+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-09T23:00:28Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik `3.7.14` (v3.2 through v3.6 lines are no longer maintained and will not get a patch; upgrade to `3.7.14`).","reach":"network","title":"Traefik: FastProxy can serve one client as another's NTLM or Negotiate identity","impact":"high","summary":"When experimental FastProxy is enabled, Traefik can reuse a backend connection on which another client completed an NTLM or Negotiate login, so an unauthenticated client on a new connection can be served as that user. An attacker gets the victim's data and can act in the victim's name without credentials.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","ntlm","kerberos"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated client gets a victim's backend session and actions","analyst_note":"","how_to_check":"- Check whether `experimental.fastProxy` is enabled in the static Traefik configuration.\n- Check the Traefik version with `traefik version`; affected versions are `3.2.0` through `3.7.13`.\n- Check whether any plain `http://` backend uses connection-bound NTLM or Negotiate authentication with keep-alive enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-fastproxy","no-ntlm-backends","https-backends"],"who_is_affected":"Only deployments that enable Traefik's experimental FastProxy, proxy plain HTTP backends that use connection-bound NTLM or Negotiate authentication, and keep backend keep-alive on. The default proxy implementation is not affected, and neither are Traefik v2 or other v3 versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000848,"input_tokens":5177,"output_tokens":661,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-488':28B '/traefik/traefik/issues).':359C '/traefik/traefik/releases/tag/v3.7.14':339C '/traefik/traefik/v3':26A '53qr':16A,21A '784g':17A,22A 'act':81B 'action':222C 'advisori':352C 'affect':232C,260C,304C,335C 'aliv':253C 'alreadi':202C 'anoth':50B 'appli':167C 'attack':73B 'authent':112C,122C,248C 'backend':2A,46B,111C,116C,146C,172C,195C,240C,250C,291C 'bind':174C 'bound':8A,106C,244C 'brand':187C 'brand-new':186C 'carri':265C 'cj35':18A,23A 'client':13A,51B,61B,121C,125C,133C,183C 'comment':349C 'complet':52B,203C 'connect':3A,7A,47B,65B,105C,117C,128C,153C,180C,190C,196C,243C,273C,279C,287C 'connection-bound':6A,104C,242C 'could':191C 'credenti':88B,231C,270C 'cwe':27B 'data':78B,219C 'dedic':275C 'default':255C 'deploy':233C 'dispatch':148C,263C 'earlier':330C 'enabl':41B,142C,236C 'ever':135C 'everi':281C 'experiment':38B,99C 'experimental.fastproxy':140C,235C 'fastproxi':1A,39B,100C,150C,261C,294C 'frontend':127C,189C,278C,286C 'get':74B 'ghsa':15A,20A 'ghsa-53qr-784g-cj35':14A,19A 'github.com':25A,338C,358C 'github.com/traefik/traefik/issues).':357C 'github.com/traefik/traefik/releases/tag/v3.7.14':337C 'github.com/traefik/traefik/v3':24A 'hand':193C 'handshak':208C 'high':93C 'host':35B 'http':239C 'ident':10A,176C 'implement':101C,257C 'inform':342C 'infrastructur':29B 'introduc':296C 'isol':103C,169C 'issu':356C 'keep':252C 'keep-al':251C 'kerbero':30B,110C 'key':157C 'kubernet':31B 'leak':5A 'line':322C 'login':57B 'longer':308C 'maintain':309C 'must':323C 'name':86B,227C 'negoti':56B,109C,207C,247C,269C 'new':64B,188C 'ntlm':32B,54B,107C,205C,245C,267C 'ntlm/negotiate':9A 'open':354C 'patch':315C,336C 'perform':221C 'persist':179C 'pin':114C 'plain':145C,238C 'pleas':353C 'pool':4A,154C,274C 'present':229C 'proxi':256C 'question':347C 'read':215C 'receiv':313C 'request':143C,264C,283C 'requir':234C 'reus':44B,292C 'self':34B 'self-host':33B 'serv':68B,136C,211C 'serverstransport':160C 'sever':94C 'subsequ':282C 'summari':89C 'target':162C 'traefik':36B,42B,97C,102C,298C,327C 'unauthent':12A,60B,182C 'upgrad':324C 'url':163C 'use':241C 'user':71B,319C 'v2':328C 'v3':331C 'v3.2':299C,300C 'v3.6':302C 'v3.7.14':326C 'version':332C 'victim':76B,84B,200C,214C,217C,225C 'victim-on':216C 'vulner':95C 'without':87B,228C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that enable Traefik's experimental FastProxy, proxy plain HTTP backends that use connection-bound NTLM or Negotiate authentication, and keep backend keep-alive on. The default proxy implementation is not affected, and neither are Traefik v2 or other v3 versions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v3"],"labels":["cwe488","go","high","infrastructure","kerberos","kubernetes","ntlm","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v3':26A '53qr':16A,21A '784g':17A,22A 'backend':2A 'bound':8A 'cj35':18A,23A 'client':13A 'connect':3A,7A 'connection-bound':6A 'fastproxi':1A 'ghsa':15A,20A 'ghsa-53qr-784g-cj35':14A,19A 'github.com':25A 'github.com/traefik/traefik/v3':24A 'ident':10A 'leak':5A 'ntlm/negotiate':9A 'pool':4A 'unauthent':12A","search_b":"'-488':28B 'act':81B 'anoth':50B 'attack':73B 'backend':46B 'client':51B,61B 'complet':52B 'connect':47B,65B 'credenti':88B 'cwe':27B 'data':78B 'enabl':41B 'experiment':38B 'fastproxi':39B 'get':74B 'host':35B 'infrastructur':29B 'kerbero':30B 'kubernet':31B 'login':57B 'name':86B 'negoti':56B 'new':64B 'ntlm':32B,54B 'reus':44B 'self':34B 'self-host':33B 'serv':68B 'traefik':36B,42B 'unauthent':60B 'user':71B 'victim':76B,84B 'without':87B","search_c":"'/traefik/traefik/issues).':359C '/traefik/traefik/releases/tag/v3.7.14':339C 'action':222C 'advisori':352C 'affect':232C,260C,304C,335C 'aliv':253C 'alreadi':202C 'appli':167C 'authent':112C,122C,248C 'backend':111C,116C,146C,172C,195C,240C,250C,291C 'bind':174C 'bound':106C,244C 'brand':187C 'brand-new':186C 'carri':265C 'client':121C,125C,133C,183C 'comment':349C 'complet':203C 'connect':105C,117C,128C,153C,180C,190C,196C,243C,273C,279C,287C 'connection-bound':104C,242C 'could':191C 'credenti':231C,270C 'data':219C 'dedic':275C 'default':255C 'deploy':233C 'dispatch':148C,263C 'earlier':330C 'enabl':142C,236C 'ever':135C 'everi':281C 'experiment':99C 'experimental.fastproxy':140C,235C 'fastproxi':100C,150C,261C,294C 'frontend':127C,189C,278C,286C 'github.com':338C,358C 'github.com/traefik/traefik/issues).':357C 'github.com/traefik/traefik/releases/tag/v3.7.14':337C 'hand':193C 'handshak':208C 'high':93C 'http':239C 'ident':176C 'implement':101C,257C 'inform':342C 'introduc':296C 'isol':103C,169C 'issu':356C 'keep':252C 'keep-al':251C 'kerbero':110C 'key':157C 'line':322C 'longer':308C 'maintain':309C 'must':323C 'name':227C 'negoti':109C,207C,247C,269C 'new':188C 'ntlm':107C,205C,245C,267C 'open':354C 'patch':315C,336C 'perform':221C 'persist':179C 'pin':114C 'plain':145C,238C 'pleas':353C 'pool':154C,274C 'present':229C 'proxi':256C 'question':347C 'read':215C 'receiv':313C 'request':143C,264C,283C 'requir':234C 'reus':292C 'serv':136C,211C 'serverstransport':160C 'sever':94C 'subsequ':282C 'summari':89C 'target':162C 'traefik':97C,102C,298C,327C 'unauthent':182C 'upgrad':324C 'url':163C 'use':241C 'user':319C 'v2':328C 'v3':331C 'v3.2':299C,300C 'v3.6':302C 'v3.7.14':326C 'version':332C 'victim':200C,214C,217C,225C 'victim-on':216C 'vulner':95C 'without':228C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-53qr-784g-cj35","url":"https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35","severity":"high","published_at":"2026-10-07T08:47:35+00:00","modified_at":"2026-10-07T08:47:35+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":2152,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35","title":"Traefik GHSA-53qr-784g-cj35: FastProxy backend connection pool leaks NTLM/Negotiate identity","kind":"advisory","source":"analyst","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:35+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}