Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 22 Oct 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity. | |
| Title | Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool | |
| First Time appeared |
Traefik
Traefik traefik |
|
| Weaknesses | CWE-287 | |
| CPEs | cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Traefik
Traefik traefik |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-22T01:43:39.232Z
Reserved: 2026-10-21T21:57:36.197Z
Link: CVE-2026-114639
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T02:16:56.800
Modified: 2026-10-22T02:16:56.800
Link: CVE-2026-114639
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses