high · CVSS v3 8.7 · CVSS v4 7

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthe…

Description

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

Scores

Severity
high
CVSS v2
7.1
CVSS v3
8.7
CVSS v4
7
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-84918

Drupal Monobank payment API improperly verifies cryptographic signatures, enabling attackers to spoof transaction signatures. The flaw exists in all releases up to 1.0.3, potentially allowing unauthorized fund transfers. Defenders should verify signature logic and apply patches promptly.

View analysis

high

CVE-2026-81163

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.

View analysis

high

CVE-2026-16648

Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. This issue affects Mailer Plus Log versions: from 0.0.0 to 1.2.7.

View analysis

high

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.

View analysis