CVE-2026-114639 Overview
CVE-2026-114639 is an authentication bypass vulnerability in Traefik, a widely deployed cloud-native reverse proxy and load balancer. The flaw exists in Traefik versions 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14. Traefik reuses backend TCP sockets authenticated with Authorization: Negotiate tokens (NTLM or Kerberos) through a globally shared connection pool. The pool never isolates connections per client identity. Unauthenticated attackers on separate frontend connections can be assigned a victim-authenticated socket and perform reads or writes under that identity. The weakness is classified under CWE-287: Improper Authentication.
Critical Impact
Remote unauthenticated attackers can hijack NTLM/Kerberos-authenticated backend connections and act with the victim's identity against protected services.
Affected Products
- Traefik 2.11.0 through 2.11.57
- Traefik 3.0.0 through 3.7.13
- Deployments proxying backends that use Authorization: Negotiate (NTLM/Kerberos)
Discovery Timeline
- 2026-10-22 - CVE-2026-114639 published to the National Vulnerability Database
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114639
Vulnerability Analysis
Traefik maintains a shared pool of persistent HTTP connections to backend services for performance. HTTP connection reuse is normally safe because HTTP authentication is request-scoped. The Negotiate authentication scheme breaks that assumption. NTLM and Kerberos authenticate the underlying TCP socket rather than the individual HTTP request. Once a connection completes the Negotiate handshake, the backend treats every subsequent request on that socket as originating from the authenticated principal.
Traefik does not tag Negotiate-authenticated sockets as identity-bound. The connection returns to the global pool and becomes eligible for assignment to any arbitrary frontend request. An attacker reaching Traefik on a separate frontend TCP connection can be routed over a pooled socket that still carries a victim's authenticated session with the backend.
Root Cause
The root cause is missing connection isolation for stateful, connection-bound authentication schemes. Traefik's backend transport treats all pooled sockets as interchangeable. The proxy does not distinguish between stateless (Bearer, Basic) and stateful (Negotiate) authentication. The behavior maps directly to CWE-287 because authentication state leaks across unrelated client sessions.
Attack Vector
An attacker sends an unauthenticated HTTP request to a Traefik route that forwards to a backend requiring NTLM or Kerberos. If a legitimate user previously authenticated through the same route, Traefik may select that user's pooled socket to carry the attacker's request. The backend responds based on the socket's existing authentication context. The attacker reads or writes data under the victim's identity without presenting credentials. Exploitation requires no user interaction and no prior access.
No public proof-of-concept code is published. See the GitHub Security Advisory GHSA-qm9f-w54v-q2qh and the VulnCheck Advisory on Traefik for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-114639
Indicators of Compromise
- Backend access logs showing successful authenticated actions where the Traefik access log for the same request shows no Authorization header.
- Mismatched source identities between frontend client IPs and backend-attributed principals in correlated logs.
- Backend audit entries referencing Kerberos or NTLM principals performing actions outside of their normal working hours or scope.
Detection Strategies
- Correlate Traefik access logs with backend application and Windows Security logs to identify requests attributed to authenticated users without a matching frontend credential.
- Audit backend applications that accept Authorization: Negotiate and sit behind Traefik, then review request-to-identity mappings for inconsistencies.
- Inventory running Traefik instances and compare versions against the fixed releases of 2.11.58 and 3.7.14.
Monitoring Recommendations
- Alert on repeated backend requests from the same pooled connection attributed to multiple distinct frontend source addresses.
- Monitor for Kerberos ticket usage or NTLM authentications on backend services at an unexpected rate following Traefik restarts.
- Enable verbose Traefik access logging including upstream connection identifiers, where supported, to make pool reuse auditable.
How to Mitigate CVE-2026-114639
Immediate Actions Required
- Upgrade Traefik to version 2.11.58 or 3.7.14 or later on every proxy instance.
- Identify every route that forwards to a backend using NTLM or Kerberos and treat it as compromised until patched.
- Rotate Kerberos service account passwords and reset NTLM machine account hashes for backends exposed through vulnerable Traefik deployments.
Patch Information
The Traefik maintainers released fixed builds in versions 2.11.58 and 3.7.14. Patch details and backport notes are documented in the GitHub Security Advisory GHSA-qm9f-w54v-q2qh. Deploy the patched binaries or container images and restart all Traefik instances to drain the vulnerable connection pool.
Workarounds
- Remove Authorization: Negotiate backends from Traefik and front them with a proxy that supports per-identity connection isolation until patching is complete.
- Disable HTTP keep-alive to backend services that use Negotiate authentication to prevent socket reuse across requests, accepting the performance cost.
- Restrict network access to affected Traefik routes to trusted client ranges while remediation is in progress.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
