GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-mhjw-hmjv-p99x · Package
FIX → v2.11.58 · v3.7.14
Traefik stores a per-client-connection backend round tripper for NTLM and Kerberos (Negotiate) backend authentication, and it reads and writes that slot without a lock. Concurrent HTTP/2 or HTTP/3 requests on one client connection can replace an in-use round tripper, breaking connection-bound authentication, and a torn read may crash the Traefik process.
first public Oct 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only deployments that proxy to backends using NTLM or Kerberos (Negotiate) authentication are exposed, because the flawed code path only runs when a backend sends those challenges. Traefik v2 from v2.11.0 and Traefik v3 from v3.0.0 to v3.7.13 are in range. Deployments that do not use NTLM or Kerberos backend auth can skip it, though upgrading is still advised.
Not affected if no-kerberos-backends, no-ntlm-backends, traefik-v1
Who cares go, kerberos, kubernetes, ntlm, self-hosted, traefik
traefik version or check the image tag to see whether you run a v2 release from v2.11.0 through v2.11.57, or a v3 release from v3.0.0 through v3.7.13.There is a medium severity vulnerability in Traefik's NTLM and Kerberos (Negotiate) backend authentication support. When a backend answers a request with a WWW-Authenticate: NTLM or Negotiate challenge, Traefik stores a dedicated backend round tripper in the client connection context so that the next requests on that client connection reuse the same authenticated backend connection. That per-connection slot was read and written without any synchronization, while HTTP/2 and HTTP/3 client connections multiplex concurrent requests over a single connection. Concurrent requests racing on the slot could replace a round tripper already in use, orphaning the backend connections it held and breaking the connection-bound authentication for that client, and a torn read of the slot may crash the Traefik process.
The fix guards the slot with a mutex and keeps the round tripper already stored for a client connection, so concurrent requests stick exactly once. The same change also dedicates the slot to the ServersTransport that created it, which is tracked separately as GHSA-cw35-4q88-3rmp.
Traefik v3.0 through v3.6 are affected and no longer receive patches; users on those lines must upgrade to v3.7.14. Traefik v2 is affected from v2.11.0, where NTLM and Kerberos support was introduced; earlier v2 releases and Traefik v1 are not affected.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v2.11.58 · v3.7.14
v2.11.58.v3.7.14.If you have any questions or comments about this advisory, please open an issue.