p PatchFirst

CVE-2026-114639

CVE-2026-114639 · Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

CVSS 7.0 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: web

Affected products and versions

  • traefik

    Versions
    • ≥ 2.11.0, < 2.11.58: Affected (semver)
    • 2.11.58: Not affected (semver)

    Update to 2.11.58

  • traefik

    Versions
    • ≥ 3.0.0, < 3.7.14: Affected (semver)
    • 3.7.14: Not affected (semver)

    Update to 3.7.14

Original sources

Check your server →