CVE-2026-114642 Overview
CVE-2026-114642 affects Traefik, an open-source reverse proxy and load balancer. The flaw lets an unauthenticated attacker bypass TLS client configuration between backend services. Traefik stores its NTLM/Kerberos backend round tripper in a client-connection slot that is not keyed by ServersTransport. As a result, one service's TLS client configuration can be reused for another service's backend on the same keep-alive connection. An attacker can arm the slot by triggering an NTLM or Negotiate challenge from one backend, then reach another backend while bypassing its root CAs, server name, and certificate verification [CWE-295].
Critical Impact
Attackers can bypass TLS certificate validation for backend services, enabling man-in-the-middle attacks and reaching protected backends with another service's credentials and trust configuration.
Affected Products
- Traefik 2.11.0 through versions before 2.11.58
- Traefik 3.0.0 through versions before 3.7.14
- Deployments using ServersTransport with NTLM or Kerberos backends
Discovery Timeline
- 2026-10-22 - CVE CVE-2026-114642 published to NVD
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-114642
Vulnerability Analysis
Traefik maintains per-connection state for backends that negotiate NTLM or Kerberos. These authentication schemes bind to a specific TCP connection rather than a single HTTP request. To support this, Traefik installs a dedicated round tripper in a connection slot. The connection slot is not keyed by the ServersTransport configuration that defines TLS behavior for a specific backend.
When Traefik reuses a keep-alive connection to serve a request routed to a different backend, the previously stored round tripper remains active. The TLS client configuration from the original backend is applied to the new request. Root certificate authorities, ServerName validation, and certificate verification settings tied to the intended backend are not enforced.
An unauthenticated client can arm the slot by issuing a request whose backend responds with a WWW-Authenticate: NTLM or Negotiate challenge. Subsequent requests reusing the same connection can then reach a different backend with weakened trust validation. This is an improper certificate validation flaw [CWE-295] in the HTTP connection reuse logic.
Root Cause
The round tripper cache key omits ServersTransport. Traefik treats the connection-level handler as backend-agnostic, allowing the TLS client state from the first backend to persist across subsequent routed requests.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction. An attacker needs the ability to send HTTP requests to a Traefik instance that routes to multiple backends, at least one of which uses NTLM or Kerberos. The attacker triggers an authentication challenge against the NTLM/Kerberos backend, then issues follow-up requests over the same keep-alive connection to reach a second backend without proper TLS validation. See the GitHub Security Advisory GHSA-cw35-4q88-3rmp for additional detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-114642
Indicators of Compromise
- Backend TLS connections presenting certificates that do not match the configured ServerName for the destination service.
- Unexpected successful connections to backends whose root CA bundle differs from the arming backend's configuration.
- Keep-alive connections where NTLM or Negotiate challenges are followed by requests routed to unrelated services.
Detection Strategies
- Inventory all Traefik deployments and compare running versions against 2.11.58 and 3.7.14.
- Review ServersTransport definitions to identify services that enable NTLM or Kerberos backends.
- Enable Traefik access logs with backend TLS metadata and search for cross-service connection reuse patterns.
Monitoring Recommendations
- Alert on Traefik backend TLS handshakes that produce certificate chain validation warnings.
- Monitor outbound connections from Traefik hosts for TLS sessions to backends not matching the request's intended target.
- Correlate WWW-Authenticate: NTLM or Negotiate responses with subsequent requests served over the same TCP session.
How to Mitigate CVE-2026-114642
Immediate Actions Required
- Upgrade Traefik 2.x deployments to version 2.11.58 or later.
- Upgrade Traefik 3.x deployments to version 3.7.14 or later.
- Audit ServersTransport configurations and restrict NTLM/Kerberos backends to isolated router groups until patched.
Patch Information
The Traefik maintainers released fixed versions 2.11.58 and 3.7.14 that correctly key the NTLM/Kerberos round tripper by ServersTransport. Review the GitHub Security Advisory GHSA-cw35-4q88-3rmp and the VulnCheck Advisory on Traefik for authoritative remediation guidance.
Workarounds
- Disable NTLM and Kerberos authentication on Traefik backends until the upgrade is applied.
- Separate NTLM/Kerberos backends into dedicated Traefik instances that do not route traffic for other services.
- Disable HTTP keep-alive on affected backends to prevent cross-service connection reuse where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
