CVE-2026-114641Low· 3.7▾ SunlitTraefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
traefik >= 2.11.0 < 2.11.58traefik >= 3.0.0 < 3.7.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114639High· 8.7Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
CVE-2026-114640High· 8.7Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
CVE-2026-114636High· 8.7Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
CVE-2026-114635High· 8.7Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
CVE-2026-114656High· 7.5Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher
CVE-2026-114638High· 8.7Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision