---
id: "GHSA-cw35-4q88-3rmp"
page: "https://infrastack.ai/live/GHSA-cw35-4q88-3rmp"
kind: "vulnerability"
aliases: ["GHSA-cw35-4q88-3rmp"]
title: "Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.58"], "affected": ">= v2.11.0, <= v2.11.57", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.14"], "affected": ">= v3.0.0, <= v3.7.13", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-295", "infrastructure", "kerberos", "ntlm", "self-hosted", "tls", "traefik"]
not_affected_if: ["default-config", "no-ntlm-or-negotiate-backends", "single-servers-transport"]
published_at: "2026-10-07T08:47:34+00:00"
first_seen_at: "2026-11-09T22:53:33+00:00"
updated_at: "2026-11-09T23:00:27+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp", "first_seen_at": "2026-11-09T22:53:33+00:00"}]
exploit_sources: []
---

# Connection-scoped NTLM/Kerberos sticky round tripper is not keyed by service, applying one service TLS client config to another

Link for people: https://infrastack.ai/live/GHSA-cw35-4q88-3rmp (this .md is for agents)

When a backend uses NTLM or Kerberos authentication, Traefik can reuse the authenticated backend connection for a different service on the same client connection. That second service then connects with the first service's TLS settings, so its root CAs, server name checks and certificate verification are skipped and the first service's client certificate is sent to it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected >= v2.11.0, <= v2.11.57 fixed v2.11.58
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.13 fixed v3.7.14

## How to check

- Check the Traefik version with `traefik version` and compare it with the affected ranges: v2.11.0 to v2.11.57, and v3.0.0 to v3.7.13.
- Look for services that use NTLM or Negotiate backend authentication and for more than one `serversTransport` in the configuration.

## Fix

- Traefik v2 line: upgrade to `v2.11.58`.
- Traefik v3 line: upgrade to `v3.7.14`. v3.0 through v3.6 no longer receive patches.

## Timeline

- 2026-11-09T22:53:33+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp

## Documents

- [advisory] Traefik GHSA-cw35-4q88-3rmp: sticky round tripper not keyed by service https://github.com/traefik/traefik/security/advisories/GHSA-cw35-4q88-3rmp

## From the sources

## Summary

There is a high severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a `WWW-Authenticate: NTLM` or `Negotiate` challenge, Traefik keeps a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the authenticated backend connection. That round tripper carries the whole transport configuration of the `ServersTransport` that created it, including its TLS client configuration, but the slot holding it was shared by every `ServersTransport`: once armed by one service, it was reused for every later request on the same client connection, including requests routed to another service using a different `ServersTransport`. The backend connection of that second service was then established with the first service's TLS settings instead of its own: its root CAs, server name and certificate verification were not applied, and the first service's client certificate was presented to its backend. An unauthenticated client can arm the slot with an ordinary request to the first service and then reach the second one on the same keep-alive connection, silently disabling the operator's TLS policy on that backend leg. The dedicated round tripper is now kept per `ServersTransport`, so a service can only ever reuse a round tripper it created.

Traefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.58
- https://github.com/traefik/traefik/releases/tag/v3.7.14

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_