CVE-2026-114641

Overview

Traefik versions 2.11.x prior to 2.11.58 and 3.x prior to 3.7.14 contain a race condition in the NTLM and Kerberos backend authentication. The flaw allows concurrent HTTP/2 or HTTP/3 requests over a single connection to orphan backend connections, break authentication, or crash the proxy. It affects deployments that rely on NTLM/Kerberos authentication for backend services.

Description

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.

Impact

The vulnerability can cause a denial‑of‑service by crashing Traefik, and it can compromise authentication integrity by breaking connection‑bound NTLM/Kerberos credentials. Defenders managing Traefik reverse proxies, especially those exposing internal services, are impacted.

Remediation

Upgrade to Traefik 2.11.58 or 3.7.14 (or later) to apply the synchronization fix. If an upgrade is not immediately possible, disable NTLM/Kerberos backends or enforce per‑connection isolation, and monitor logs for orphaned connections or authentication failures.

Risk context

The CVSS v3 score of 3.7 and v4 score of 6.3 indicate a medium‑severity issue with no EPSS data. While the risk is moderate, the potential for service disruption warrants timely remediation.

Affected products

• Traefik 2.11.x
• Traefik 3.x