CVE-2026-114641: Traefik Race Condition Vulnerability

CVE-2026-114641 Overview

CVE-2026-114641 is a race condition [CWE-362] in the Traefik reverse proxy affecting versions 2.11.x before 2.11.58 and 3.x before 3.7.14. The flaw resides in the per-connection sticky round tripper used for NTLM and Kerberos (Negotiate) backend authentication. Traefik reads and writes the sticky slot without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over a single connection to orphan backend connections, break connection-bound authentication, or crash the proxy.

Critical Impact
Unauthenticated remote attackers can trigger denial of service against Traefik instances or disrupt NTLM/Kerberos authentication flows by issuing concurrent multiplexed requests.

Affected Products

Traefik 2.11.x prior to 2.11.58
Traefik 3.x prior to 3.7.14
Deployments relying on NTLM or Kerberos (Negotiate) backend authentication

Discovery Timeline

2026-10-22 - CVE CVE-2026-114641 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114641

Vulnerability Analysis

Traefik maintains a per-connection sticky round tripper to preserve connection affinity required by NTLM and Kerberos (Negotiate) authentication schemes. Both protocols bind authentication state to the underlying TCP connection, so requests belonging to the same client must traverse the same backend connection throughout the handshake.

The sticky slot that stores this backend binding is accessed from multiple goroutines without synchronization primitives. When concurrent requests arrive over a single multiplexed transport, overlapping reads and writes to the slot produce inconsistent state. This can orphan backend connections, misroute authentication challenges, or dereference stale pointers and crash the process.

Root Cause

The root cause is a classic data race [CWE-362] on shared mutable state. The round tripper assumes serialized access per connection, which holds for HTTP/1.1 but not for HTTP/2 or HTTP/3 where a single transport carries many concurrent streams. The missing mutex or atomic operation around the sticky slot allows interleaved execution to corrupt the connection binding.

Attack Vector

An unauthenticated remote attacker opens a single HTTP/2 or HTTP/3 connection to a vulnerable Traefik instance fronting an NTLM or Kerberos backend. The attacker then issues concurrent streams targeting the authenticated route. Interleaved access to the sticky slot breaks authentication continuity or crashes the Traefik process, producing a denial of service. See the GitHub Security Advisory GHSA-mhjw-hmjv-p99x and the VulnCheck Advisory for Traefik for additional detail.

Detection Methods for CVE-2026-114641

Indicators of Compromise

Unexpected Traefik process restarts or panics in logs during periods of HTTP/2 or HTTP/3 traffic
Spikes in failed NTLM or Kerberos (Negotiate) handshakes against backends fronted by Traefik
Orphaned backend TCP connections persisting after client disconnects
Clients receiving 401 Unauthorized responses despite valid credentials

Detection Strategies

Inventory Traefik deployments and compare running versions against 2.11.58 and 3.7.14 thresholds
Correlate Traefik crash events with concurrent multiplexed stream counts per source IP
Monitor authentication backend logs for interleaved or mis-attributed Negotiate challenges

Monitoring Recommendations

Export Traefik access and error logs to a centralized log platform and alert on panic traces
Track backend connection pool metrics for growth that does not correlate with request volume
Alert on sudden drops in successful NTLM or Kerberos authentications behind Traefik

How to Mitigate CVE-2026-114641

Immediate Actions Required

Upgrade Traefik 2.x to version 2.11.58 or later
Upgrade Traefik 3.x to version 3.7.14 or later
Audit routes using NTLM or Kerberos (Negotiate) backend authentication and prioritize them for patching
Restrict exposure of vulnerable instances by placing them behind authenticated network perimeters until patched

Patch Information

Traefik maintainers released fixed versions 2.11.58 and 3.7.14 that add synchronization around the sticky round tripper slot. Refer to the GitHub Security Advisory GHSA-mhjw-hmjv-p99x for the official patch references and release notes.

Workarounds

Disable HTTP/2 and HTTP/3 on routes that use NTLM or Kerberos backend authentication, forcing HTTP/1.1 which serializes requests per connection
Terminate NTLM or Kerberos authentication at a different proxy that is not affected until Traefik can be upgraded
Apply rate limiting on concurrent streams per client connection to reduce exploitability pending patch deployment

bash

# Example: pin Traefik to a fixed version in a Docker Compose deployment
services:
  traefik:
    image: traefik:3.7.14
    command:
      - --entrypoints.websecure.http.tls=true
      - --entrypoints.websecure.http2.disabled=true  # workaround for NTLM/Kerberos routes