CVE-2026-114639 — Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authentic…
Published: 2026-10-22 · CVSS: 7.0 · CVSS 4.0
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7