---
id: "GHSA-53qr-784g-cj35"
page: "https://infrastack.ai/live/GHSA-53qr-784g-cj35"
kind: "vulnerability"
aliases: ["GHSA-53qr-784g-cj35"]
title: "FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.2.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-488", "infrastructure", "kerberos", "kubernetes", "ntlm", "self-hosted", "traefik"]
not_affected_if: ["default-config", "https-backends", "no-fastproxy", "no-ntlm-backends"]
published_at: "2026-10-07T08:47:35+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T23:00:28+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# FastProxy backend connection pool leaks connection-bound NTLM/Negotiate identity to unauthenticated clients

Link for people: https://infrastack.ai/live/GHSA-53qr-784g-cj35 (this .md is for agents)

When experimental FastProxy is enabled, Traefik can reuse a backend connection on which another client completed an NTLM or Negotiate login, so an unauthenticated client on a new connection can be served as that user. An attacker gets the victim's data and can act in the victim's name without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v3 affected >= v3.2.0, <= v3.7.13 fixed v3.7.14

## How to check

- Check whether `experimental.fastProxy` is enabled in the static Traefik configuration.
- Check the Traefik version with `traefik version`; affected versions are `3.2.0` through `3.7.13`.
- Check whether any plain `http://` backend uses connection-bound NTLM or Negotiate authentication with keep-alive enabled.

## Fix

- Traefik `3.7.14` (v3.2 through v3.6 lines are no longer maintained and will not get a patch; upgrade to `3.7.14`).

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35

## Documents

- [advisory] Traefik GHSA-53qr-784g-cj35: FastProxy backend connection pool leaks NTLM/Negotiate identity https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35

## From the sources

## Summary

There is a high severity vulnerability in Traefik's experimental FastProxy implementation. Traefik isolates connection-bound NTLM and Negotiate (Kerberos) backend authentication by pinning the backend connection on which a client authenticated to that client's frontend connection, so that no other client is ever served on it. When `experimental.fastProxy` is enabled, requests to plain `http://` backends are dispatched through FastProxy's own connection pool, which was keyed only by ServersTransport and target URL and did not apply that isolation. Against a backend that binds an identity to a persistent connection, an unauthenticated client on a brand-new frontend connection could be handed a backend connection on which a victim had already completed an NTLM or Negotiate handshake, and be served as that victim, reading victim-only data and performing actions in the victim's name without presenting any credentials. Affected deployments require `experimental.fastProxy` enabled, a plain HTTP backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive; the default proxy implementation is not affected. FastProxy now dispatches requests carrying an NTLM or Negotiate credential through a connection pool dedicated to their frontend connection, and every subsequent request on that frontend connection to the same backend reuses it.

FastProxy was introduced in Traefik v3.2: v3.2 through v3.6 are affected but are no longer maintained and will not receive a patch of their own, users on those lines must upgrade to v3.7.14. Traefik v2 and earlier v3 versions are not affected.

## Patches

- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_