CVE-2026-114642High· 8.7▾ TwilightTraefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's bac…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.
traefik >= 2.11.0 < 2.11.58traefik >= 3.0.0 < 3.7.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66491Medium· 5.9Traefik is an HTTP reverse proxy and load balancer
CVE-2026-114639High· 8.7Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool
CVE-2026-114640High· 8.7Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router
CVE-2026-114636High· 8.7Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router
CVE-2026-114635High· 8.7Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme
CVE-2026-114656High· 7.5Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher