Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 22 Oct 2026 02:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification. | |
| Title | Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper | |
| First Time appeared |
Traefik
Traefik traefik |
|
| Weaknesses | CWE-295 | |
| CPEs | cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Traefik
Traefik traefik |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-22T01:43:41.355Z
Reserved: 2026-10-21T21:57:36.197Z
Link: CVE-2026-114642
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T02:16:57.250
Modified: 2026-10-22T02:16:57.250
Link: CVE-2026-114642
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses