CVE-2026-114639 | BDVDB-2026-394549 Detail

Description#

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on separate frontend connections can be assigned that NTLM/Kerberos-bound socket and perform reads or writes with the victim's identity.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-22Record published in the CVE List.
2. Version 22026-11-04Most recent update recorded in the CVE List.