{"id":"GHSA-qm9f-w54v-q2qh","kind":"vulnerability","aliases":["GHSA-qm9f-w54v-q2qh"],"related":[],"title":"Preauthenticated Negotiate contaminates Traefik's globally shared backend connection pool","description":"## Summary\n\nThere is a high severity authentication vulnerability in Traefik's handling of connection-bound backend authentication (NTLM and SPNEGO/Kerberos \"Negotiate\"). For each new frontend connection, Traefik sends the first backend request through a globally shared transport and only switches that connection to an isolated, per-frontend-connection transport *after* it observes an NTLM/Negotiate challenge in the backend's response. When a client preauthenticates — sending a valid `Authorization: Negotiate` token on its first request instead of following the standard challenge-first (`401`) handshake — the backend authenticates the shared-pool connection on that first request and returns a successful response. Because isolation is decided only after the response is seen, the now victim-authenticated backend socket remains in the shared pool, and it is neither drained nor closed. An unrelated, unauthenticated client on a completely separate frontend connection can then be assigned that socket and act with the victim's identity, performing victim-authorized reads or writes.\n\nExploitation requires Traefik to proxy a connection-bound NTLM/Negotiate backend with connection reuse enabled, and a legitimate client that preauthenticates rather than following the standard challenge-first handshake. The ordinary challenge-first flow is not affected: it installs a dedicated backend transport before the credential-bearing request, so the authenticated socket never enters the shared pool. This is a distinct issue from GHSA-qqjf-53cj-pwvv (which fixed a missing HTTP/3 transport holder): it occurs on ordinary HTTP/1.1 and HTTP/2 frontend connections because the credential-bearing first request reaches the shared pool before any holder can isolate it. The behavior was introduced together with connection-bound NTLM/Kerberos support in v2.11.0 and v3.0.0. Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line, and users on those versions must upgrade to v3.7.14.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.58\n- https://github.com/traefik/traefik/releases/tag/v3.7.14\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik can reuse a backend connection that a preauthenticating client has already logged in on, and hand that connection to an unrelated unauthenticated client. The unrelated client then acts with the victim's identity on the backend, reading or writing data the victim could access.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.58"],"affected":">= v2.11.0, <= v2.11.57","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.14"],"affected":">= v3.0.0, <= v3.7.13","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-287","cwe-863","go","kerberos","kubernetes","ntlm","runtime","self-hosted","traefik","windows-auth"],"not_affected_if":["connection-reuse-disabled","managed-hosting","no-negotiate-backends"],"how_to_check":"- Run `traefik version` and compare against the fixed versions below.\n- Check whether your Traefik routes to NTLM or Kerberos (Negotiate) backends with connection reuse enabled.\n- Check the Go module version in `go.mod` for `github.com/traefik/traefik/v2` or `github.com/traefik/traefik/v3`.","fix":"- Traefik v2: upgrade to `v2.11.58`\n- Traefik v3: upgrade to `v3.7.14` (v3.0 through v3.6 are end-of-life and receive no fix on their own line)","status":"open","published_at":"2026-10-07T08:47:33+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","triaged_at":"2026-11-09T23:00:27+00:00","updated_at":"2026-11-09T23:00:27+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T23:00:27Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: upgrade to `v2.11.58`\n- Traefik v3: upgrade to `v3.7.14` (v3.0 through v3.6 are end-of-life and receive no fix on their own line)","reach":"network","title":"Traefik: preauthenticated Negotiate lets one client act as another via shared connections","impact":"high","summary":"Traefik can reuse a backend connection that a preauthenticating client has already logged in on, and hand that connection to an unrelated unauthenticated client. The unrelated client then acts with the victim's identity on the backend, reading or writing data the victim could access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","go","self-hosted","kubernetes","windows-auth","kerberos","ntlm"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unrelated client acts as victim on backend, reading or writing data","analyst_note":"","how_to_check":"- Run `traefik version` and compare against the fixed versions below.\n- Check whether your Traefik routes to NTLM or Kerberos (Negotiate) backends with connection reuse enabled.\n- Check the Go module version in `go.mod` for `github.com/traefik/traefik/v2` or `github.com/traefik/traefik/v3`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-negotiate-backends","connection-reuse-disabled","managed-hosting"],"who_is_affected":"Exposure requires Traefik proxying a connection-bound NTLM or Negotiate (SPNEGO/Kerberos) backend with connection reuse enabled, and a client that sends a Negotiate token on its first request instead of following the challenge-first handshake. Deployments that only proxy ordinary backends, or use the standard challenge-first flow, are not affected by the shared-pool path described.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000886,"input_tokens":5402,"output_tokens":691,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-287':28B '-863':30B '/traefik/traefik/issues).':427C '/traefik/traefik/releases/tag/v2.11.58':404C '/traefik/traefik/releases/tag/v3.7.14':407C '/traefik/traefik/v2':23A '/traefik/traefik/v3':26A '401':172C '53cj':319C 'access':87B 'act':71B,237C 'advisori':420C 'affect':288C,381C 'alreadi':54B 'also':380C 'assign':233C 'auth':42B 'authent':94C,105C,176C,205C,303C 'author':157C,246C 'backend':8A,47B,79B,104C,119C,147C,175C,206C,260C,293C 'bear':299C,341C 'behavior':355C 'bound':103C,258C,362C 'challeng':144C,170C,277C,283C 'challenge-first':169C,276C,282C 'client':52B,66B,69B,152C,223C,268C 'close':219C 'comment':417C 'complet':226C 'connect':9A,48B,61B,102C,114C,130C,137C,181C,229C,257C,262C,336C,361C 'connection-bound':101C,256C,360C 'contamin':3A 'could':86B 'credenti':298C,340C 'credential-bear':297C,339C 'cwe':27B,29B 'data':83B 'decid':194C 'dedic':292C 'distinct':313C 'drain':217C 'enabl':264C 'end':375C 'end-of-lif':374C 'enter':306C 'exploit':250C 'first':118C,162C,171C,184C,278C,284C,342C 'fix':322C,387C 'flow':285C 'follow':166C,273C 'frontend':113C,136C,228C,335C 'ghsa':12A,17A,317C 'ghsa-qm9f-w54v-q2qh':11A,16A 'ghsa-qqjf-53cj-pwvv':316C 'github.com':22A,25A,403C,406C,426C 'github.com/traefik/traefik/issues).':425C 'github.com/traefik/traefik/releases/tag/v2.11.58':402C 'github.com/traefik/traefik/releases/tag/v3.7.14':405C 'github.com/traefik/traefik/v2':21A 'github.com/traefik/traefik/v3':24A 'global':6A,123C 'go':31B 'hand':59B 'handl':99C 'handshak':173C,279C 'high':92C 'holder':327C,350C 'host':38B 'http/1.1':332C 'http/2':334C 'http/3':325C 'ident':76B,242C 'inform':410C 'instal':290C 'instead':164C 'introduc':357C 'isol':133C,192C,352C 'issu':314C,424C 'kerbero':32B 'kubernet':33B 'legitim':267C 'life':377C 'line':391C 'log':55B 'miss':324C 'must':397C 'negoti':2A,109C,158C 'neither':216C 'never':305C 'new':112C 'ntlm':34B,106C 'ntlm/kerberos':363C 'ntlm/negotiate':143C,259C 'observ':141C 'occur':329C 'open':422C 'ordinari':281C,331C 'patch':401C 'per':135C 'per-frontend-connect':134C 'perform':243C 'pleas':421C 'pool':10A,180C,212C,309C,347C 'preauthent':1A,51B,153C,270C 'proxi':254C 'pwvv':320C 'q2qh':15A,20A 'qm9f':13A,18A 'qqjf':318C 'question':415C 'rather':271C 'reach':344C 'read':80B,247C 'receiv':385C 'remain':208C 'request':120C,163C,185C,300C,343C 'requir':251C 'respons':149C,190C,198C 'return':187C 'reus':45B,263C 'runtim':35B 'seen':200C 'self':37B 'self-host':36B 'send':116C,154C 'separ':227C 'sever':93C 'share':7A,124C,179C,211C,308C,346C 'shared-pool':178C 'socket':207C,235C,304C 'spnego/kerberos':108C 'standard':168C,275C 'success':189C 'summari':88C 'support':364C 'switch':128C 'togeth':358C 'token':159C 'traefik':4A,39B,43B,97C,115C,252C,369C 'transport':125C,138C,294C,326C 'unauthent':65B,222C 'unrel':64B,68B,221C 'upgrad':398C 'user':393C 'v2.11.0':366C 'v3.0':370C 'v3.0.0':368C 'v3.6':372C 'v3.7.14':400C 'valid':156C 'version':396C 'victim':74B,85B,204C,240C,245C 'victim-authent':203C 'victim-author':244C 'vulner':95C 'w54v':14A,19A 'window':41B 'windows-auth':40B 'write':82B,249C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires Traefik proxying a connection-bound NTLM or Negotiate (SPNEGO/Kerberos) backend with connection reuse enabled, and a client that sends a Negotiate token on its first request instead of following the challenge-first handshake. Deployments that only proxy ordinary backends, or use the standard challenge-first flow, are not affected by the shared-pool path described.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe287","cwe863","go","high","kerberos","kubernetes","ntlm","runtime","selfhosted","traefik","windowsauth"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':23A '/traefik/traefik/v3':26A 'backend':8A 'connect':9A 'contamin':3A 'ghsa':12A,17A 'ghsa-qm9f-w54v-q2qh':11A,16A 'github.com':22A,25A 'github.com/traefik/traefik/v2':21A 'github.com/traefik/traefik/v3':24A 'global':6A 'negoti':2A 'pool':10A 'preauthent':1A 'q2qh':15A,20A 'qm9f':13A,18A 'share':7A 'traefik':4A 'w54v':14A,19A","search_b":"'-287':28B '-863':30B 'access':87B 'act':71B 'alreadi':54B 'auth':42B 'backend':47B,79B 'client':52B,66B,69B 'connect':48B,61B 'could':86B 'cwe':27B,29B 'data':83B 'go':31B 'hand':59B 'host':38B 'ident':76B 'kerbero':32B 'kubernet':33B 'log':55B 'ntlm':34B 'preauthent':51B 'read':80B 'reus':45B 'runtim':35B 'self':37B 'self-host':36B 'traefik':39B,43B 'unauthent':65B 'unrel':64B,68B 'victim':74B,85B 'window':41B 'windows-auth':40B 'write':82B","search_c":"'/traefik/traefik/issues).':427C '/traefik/traefik/releases/tag/v2.11.58':404C '/traefik/traefik/releases/tag/v3.7.14':407C '401':172C '53cj':319C 'act':237C 'advisori':420C 'affect':288C,381C 'also':380C 'assign':233C 'authent':94C,105C,176C,205C,303C 'author':157C,246C 'backend':104C,119C,147C,175C,206C,260C,293C 'bear':299C,341C 'behavior':355C 'bound':103C,258C,362C 'challeng':144C,170C,277C,283C 'challenge-first':169C,276C,282C 'client':152C,223C,268C 'close':219C 'comment':417C 'complet':226C 'connect':102C,114C,130C,137C,181C,229C,257C,262C,336C,361C 'connection-bound':101C,256C,360C 'credenti':298C,340C 'credential-bear':297C,339C 'decid':194C 'dedic':292C 'distinct':313C 'drain':217C 'enabl':264C 'end':375C 'end-of-lif':374C 'enter':306C 'exploit':250C 'first':118C,162C,171C,184C,278C,284C,342C 'fix':322C,387C 'flow':285C 'follow':166C,273C 'frontend':113C,136C,228C,335C 'ghsa':317C 'ghsa-qqjf-53cj-pwvv':316C 'github.com':403C,406C,426C 'github.com/traefik/traefik/issues).':425C 'github.com/traefik/traefik/releases/tag/v2.11.58':402C 'github.com/traefik/traefik/releases/tag/v3.7.14':405C 'global':123C 'handl':99C 'handshak':173C,279C 'high':92C 'holder':327C,350C 'http/1.1':332C 'http/2':334C 'http/3':325C 'ident':242C 'inform':410C 'instal':290C 'instead':164C 'introduc':357C 'isol':133C,192C,352C 'issu':314C,424C 'legitim':267C 'life':377C 'line':391C 'miss':324C 'must':397C 'negoti':109C,158C 'neither':216C 'never':305C 'new':112C 'ntlm':106C 'ntlm/kerberos':363C 'ntlm/negotiate':143C,259C 'observ':141C 'occur':329C 'open':422C 'ordinari':281C,331C 'patch':401C 'per':135C 'per-frontend-connect':134C 'perform':243C 'pleas':421C 'pool':180C,212C,309C,347C 'preauthent':153C,270C 'proxi':254C 'pwvv':320C 'qqjf':318C 'question':415C 'rather':271C 'reach':344C 'read':247C 'receiv':385C 'remain':208C 'request':120C,163C,185C,300C,343C 'requir':251C 'respons':149C,190C,198C 'return':187C 'reus':263C 'seen':200C 'send':116C,154C 'separ':227C 'sever':93C 'share':124C,179C,211C,308C,346C 'shared-pool':178C 'socket':207C,235C,304C 'spnego/kerberos':108C 'standard':168C,275C 'success':189C 'summari':88C 'support':364C 'switch':128C 'togeth':358C 'token':159C 'traefik':97C,115C,252C,369C 'transport':125C,138C,294C,326C 'unauthent':222C 'unrel':221C 'upgrad':398C 'user':393C 'v2.11.0':366C 'v3.0':370C 'v3.0.0':368C 'v3.6':372C 'v3.7.14':400C 'valid':156C 'version':396C 'victim':204C,240C,245C 'victim-authent':203C 'victim-author':244C 'vulner':95C 'write':249C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-07T08:47:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-qm9f-w54v-q2qh","url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","severity":"high","published_at":"2026-10-07T08:47:33+00:00","modified_at":"2026-10-07T08:47:33+00:00","first_seen_at":"2026-11-09T22:53:33+00:00","fetched_at":"2026-11-09T22:53:33+00:00","note":null}],"documents":[{"id":2145,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh","title":"GHSA-qm9f-w54v-q2qh: Preauthenticated Negotiate contaminates Traefik's shared backend pool","kind":"advisory","source":"analyst","publisher":"vendor","text":null,"published_at":"2026-10-07T08:47:33+00:00","relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}