{"id":"GHSA-cw35-4q88-3rmp","kind":"vulnerability","aliases":["GHSA-cw35-4q88-3rmp"],"related":[],"title":"Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another","description":"## Summary\n\nThere is a high severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a `WWW-Authenticate: NTLM` or `Negotiate` challenge, Traefik keeps a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the authenticated backend connection. That round tripper carries the whole transport configuration of the `ServersTransport` that created it, including its TLS client configuration, but the slot holding it was shared by every `ServersTransport`: once armed by one service, it was reused for every later request on the same client connection, including requests routed to another service using a different `ServersTransport`. The backend connection of that second service was then established with the first service's TLS settings instead of its own: its root CAs, server name and certificate verification were not applied, and the first service's client certificate was presented to its backend. An unauthenticated client can arm the slot with an ordinary request to the first service and then reach the second one on the same keep-alive connection, silently disabling the operator's TLS policy on that backend leg. The dedicated round tripper is now kept per `ServersTransport`, so a service can only ever reuse a round tripper it created.\n\nTraefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"When a backend uses NTLM or Kerberos authentication, Traefik can reuse the authenticated backend connection for a different service on the same client connection. That second service then connects with the first service's TLS settings, so its root CAs, server name checks and certificate verification are skipped and the first service's client certificate is sent to it.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.58"],"affected":">= v2.11.0, <= v2.11.57","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.0.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-295","infrastructure","kerberos","ntlm","self-hosted","tls","traefik"],"not_affected_if":["default-config","no-ntlm-or-negotiate-backends","single-servers-transport"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it with the affected ranges: v2.11.0 to v2.11.57, and v3.0.0 to v3.7.13.\n- Look for services that use NTLM or Negotiate backend authentication and for more than one `serversTransport` in the configuration.","fix":"- Traefik v2 line: upgrade to `v2.11.58`.\n- Traefik v3 line: upgrade to `v3.7.14`. v3.0 through v3.6 no longer receive patches.","status":"open","published_at":"2026-10-07T08:47:34+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:27+00:00","updated_at":"2026-11-09T23:00:27+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-09T23:00:27Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2 line: upgrade to `v2.11.58`.\n- Traefik v3 line: upgrade to `v3.7.14`. v3.0 through v3.6 no longer receive patches.","reach":"internet","title":"Traefik: keep-alive connection reuses one service's TLS settings for another","impact":"medium","summary":"When a backend uses NTLM or Kerberos authentication, Traefik can reuse the authenticated backend connection for a different service on the same client connection. That second service then connects with the first service's TLS settings, so its root CAs, server name checks and certificate verification are skipped and the first service's client certificate is sent to it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","self-hosted","tls","ntlm","kerberos"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"backend TLS verification skipped and client certificate sent to another service","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it with the affected ranges: v2.11.0 to v2.11.57, and v3.0.0 to v3.7.13.\n- Look for services that use NTLM or Negotiate backend authentication and for more than one `serversTransport` in the configuration.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-ntlm-or-negotiate-backends","single-servers-transport","default-config"],"who_is_affected":"Only deployments that use NTLM or Kerberos (Negotiate) backend authentication are exposed, and the flaw needs at least two services with different ServersTransport settings reached over the same keep-alive client connection. An unauthenticated client can trigger it with ordinary requests. Setups without NTLM or Negotiate backends, and Traefik v1 or v2 releases before v2.11.0, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000874,"input_tokens":5233,"output_tokens":701,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-295':38B '/traefik/traefik/issues).':389C '/traefik/traefik/releases/tag/v2.11.58':366C '/traefik/traefik/releases/tag/v3.7.14':369C '/traefik/traefik/v2':33A '/traefik/traefik/v3':36A '3rmp':25A,30A '4q88':24A,29A 'advisori':382C 'affect':327C,344C,362C 'aliv':288C 'anoth':20A,212C 'answer':124C 'appli':13A,249C 'arm':192C,266C 'authent':54B,59B,119C,131C,159C 'backend':49B,60B,118C,123C,140C,160C,219C,261C,299C 'carri':165C 'cas':86B,241C 'certif':91B,101B,245C,256C 'challeng':135C 'check':89B 'client':17A,69B,100B,145C,155C,179C,206C,255C,264C 'comment':379C 'config':18A 'configur':169C,180C 'connect':2A,61B,70B,75B,146C,156C,161C,207C,220C,289C 'connection-scop':1A 'context':147C 'creat':174C,321C 'cw35':23A,28A 'cwe':37B 'dedic':139C,302C 'differ':64B,216C 'disabl':291C 'earlier':354C 'establish':227C 'ever':315C 'everi':189C,200C 'first':78B,97B,230C,252C,275C 'ghsa':22A,27A 'ghsa-cw35-4q88-3rmp':21A,26A 'github.com':32A,35A,365C,368C,388C 'github.com/traefik/traefik/issues).':387C 'github.com/traefik/traefik/releases/tag/v2.11.58':364C 'github.com/traefik/traefik/releases/tag/v3.7.14':367C 'github.com/traefik/traefik/v2':31A 'github.com/traefik/traefik/v3':34A 'high':108C 'hold':184C 'host':44B 'includ':176C,208C 'inform':372C 'infrastructur':39B 'instead':235C 'introduc':353C 'issu':386C 'keep':137C,287C 'keep-al':286C 'kept':307C 'kerbero':40B,53B,116C,350C 'key':10A 'later':201C 'leg':300C 'line':336C 'longer':330C 'must':337C 'name':88B,243C 'negoti':117C,134C 'next':151C 'ntlm':41B,51B,114C,132C,348C 'ntlm/kerberos':4A 'one':14A,194C,282C 'open':384C 'oper':293C 'ordinari':271C 'patch':332C,363C 'per':308C 'pleas':383C 'polici':296C 'present':258C 'question':377C 'reach':279C 'receiv':331C 'releas':356C 'request':126C,152C,202C,209C,272C 'reus':57B,157C,198C,316C 'root':85B,240C 'round':6A,141C,163C,303C,318C 'rout':210C 'scope':3A 'second':72B,223C,281C 'self':43B 'self-host':42B 'sent':103B 'server':87B,242C 'serverstransport':172C,190C,217C,309C 'servic':12A,15A,65B,73B,79B,98B,195C,213C,224C,231C,253C,276C,312C 'set':82B,234C 'sever':109C 'share':187C 'silent':290C 'skip':94B 'slot':183C,268C 'sticki':5A 'summari':104C 'support':120C,351C 'tls':16A,45B,81B,178C,233C,295C 'traefik':46B,55B,112C,136C,322C,341C,358C 'transport':168C 'tripper':7A,142C,164C,304C,319C 'unauthent':263C 'upgrad':338C 'use':50B,214C 'user':333C 'v1':359C 'v2':342C,355C 'v2.11.0':346C 'v3.0':323C 'v3.6':325C 'v3.7.14':340C 'verif':92B,246C 'vulner':110C 'whole':167C 'www':130C 'www-authent':129C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use NTLM or Kerberos (Negotiate) backend authentication are exposed, and the flaw needs at least two services with different ServersTransport settings reached over the same keep-alive client connection. An unauthenticated client can trigger it with ordinary requests. Setups without NTLM or Negotiate backends, and Traefik v1 or v2 releases before v2.11.0, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe295","go","high","infrastructure","kerberos","ntlm","selfhosted","tls","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':33A '/traefik/traefik/v3':36A '3rmp':25A,30A '4q88':24A,29A 'anoth':20A 'appli':13A 'client':17A 'config':18A 'connect':2A 'connection-scop':1A 'cw35':23A,28A 'ghsa':22A,27A 'ghsa-cw35-4q88-3rmp':21A,26A 'github.com':32A,35A 'github.com/traefik/traefik/v2':31A 'github.com/traefik/traefik/v3':34A 'key':10A 'ntlm/kerberos':4A 'one':14A 'round':6A 'scope':3A 'servic':12A,15A 'sticki':5A 'tls':16A 'tripper':7A","search_b":"'-295':38B 'authent':54B,59B 'backend':49B,60B 'cas':86B 'certif':91B,101B 'check':89B 'client':69B,100B 'connect':61B,70B,75B 'cwe':37B 'differ':64B 'first':78B,97B 'host':44B 'infrastructur':39B 'kerbero':40B,53B 'name':88B 'ntlm':41B,51B 'reus':57B 'root':85B 'second':72B 'self':43B 'self-host':42B 'sent':103B 'server':87B 'servic':65B,73B,79B,98B 'set':82B 'skip':94B 'tls':45B,81B 'traefik':46B,55B 'use':50B 'verif':92B","search_c":"'/traefik/traefik/issues).':389C '/traefik/traefik/releases/tag/v2.11.58':366C '/traefik/traefik/releases/tag/v3.7.14':369C 'advisori':382C 'affect':327C,344C,362C 'aliv':288C 'anoth':212C 'answer':124C 'appli':249C 'arm':192C,266C 'authent':119C,131C,159C 'backend':118C,123C,140C,160C,219C,261C,299C 'carri':165C 'cas':241C 'certif':245C,256C 'challeng':135C 'client':145C,155C,179C,206C,255C,264C 'comment':379C 'configur':169C,180C 'connect':146C,156C,161C,207C,220C,289C 'context':147C 'creat':174C,321C 'dedic':139C,302C 'differ':216C 'disabl':291C 'earlier':354C 'establish':227C 'ever':315C 'everi':189C,200C 'first':230C,252C,275C 'github.com':365C,368C,388C 'github.com/traefik/traefik/issues).':387C 'github.com/traefik/traefik/releases/tag/v2.11.58':364C 'github.com/traefik/traefik/releases/tag/v3.7.14':367C 'high':108C 'hold':184C 'includ':176C,208C 'inform':372C 'instead':235C 'introduc':353C 'issu':386C 'keep':137C,287C 'keep-al':286C 'kept':307C 'kerbero':116C,350C 'later':201C 'leg':300C 'line':336C 'longer':330C 'must':337C 'name':243C 'negoti':117C,134C 'next':151C 'ntlm':114C,132C,348C 'one':194C,282C 'open':384C 'oper':293C 'ordinari':271C 'patch':332C,363C 'per':308C 'pleas':383C 'polici':296C 'present':258C 'question':377C 'reach':279C 'receiv':331C 'releas':356C 'request':126C,152C,202C,209C,272C 'reus':157C,198C,316C 'root':240C 'round':141C,163C,303C,318C 'rout':210C 'second':223C,281C 'server':242C 'serverstransport':172C,190C,217C,309C 'servic':195C,213C,224C,231C,253C,276C,312C 'set':234C 'sever':109C 'share':187C 'silent':290C 'slot':183C,268C 'summari':104C 'support':120C,351C 'tls':178C,233C,295C 'traefik':112C,136C,322C,341C,358C 'transport':168C 'tripper':142C,164C,304C,319C 'unauthent':263C 'upgrad':338C 'use':214C 'user':333C 'v1':359C 'v2':342C,355C 'v2.11.0':346C 'v3.0':323C 'v3.6':325C 'v3.7.14':340C 'verif':246C 'vulner':110C 'whole':167C 'www':130C 'www-authent':129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-cw35-4q88-3rmp","url":"https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp","severity":"high","published_at":"2026-10-07T08:47:34+00:00","modified_at":"2026-10-07T08:47:34+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":2147,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp","title":"Traefik GHSA-cw35-4q88-3rmp: sticky round tripper not keyed by service","kind":"advisory","source":"analyst","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:34+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}