Traefik CVE-2026-114637

Exploitation requires that the experimental FastProxy connection pool is enabled (a non-default Traefik configuration) AND that backends behind Traefik use NTLM or Negotiate authentication. The attacker must also catch a pooled keep-alive backend connection on which a victim has completed an NTLM/Negotiate handshake - an opportunistic timing dependency (reflected as AT:P), not attacker-controlled. Limiting factors: affected only in versions v3.2.0 through before v3.7.14; the vulnerable path is experimental and off by default; it is irrelevant unless backends perform connection-oriented NTLM/Negotiate auth; and impact is confined to inheriting the victim's backend identity rather than compromising Traefik itself.

The vendor CVSS 4.0 score of 7.0 (High) reflects a connection-identity leak (CWE-488) rather than a direct system compromise: on the vulnerable Traefik instance itself impact is null (VC:N/VI:N/VA:N), but the subsequent (backend) system suffers high confidentiality and integrity impact (SC:H/SI:H) because an unauthenticated client inherits a victim's NTLM/Negotiate-authenticated backend session. The vector is network-reachable and low-complexity (AV:N/AC:L/PR:N/UI:N), which sounds alarming, but the AT:P flag is decisive - exploitation REQUIRES the precondition that a victim has completed an NTLM/Negotiate handshake on a connection that then gets pooled and handed to the attacker, i.e. an opportunistic timing/race condition the attacker cannot fully control. Crucially, the flaw only exists in the EXPERIMENTAL FastProxy connection pool, which is not Traefik's default proxying path, and only matters where backends use NTLM/Negotiate auth. No EPSS score was provided in the input, there is no CISA KEV listing, and no public exploit was referenced, so exploitation status is 'no public exploit identified at time of analysis.' Net: this is a genuine authentication-bypass/identity-leak worth patching promptly in affected deployments, but its real-world blast radius is gated by a non-default experimental feature plus an NTLM/Negotiate backend, making it meaningfully lower priority than the network-vector metrics alone suggest. Missing signal to note: no EPSS and no POC data were supplied, so probability-of-exploitation cannot be quantified from the input.

An attacker sends requests through a Traefik instance that has the experimental FastProxy connection pool enabled in front of NTLM/Negotiate-authenticated backends. Shortly after a legitimate victim completes an NTLM or Negotiate handshake, the attacker is handed that same pooled keep-alive backend connection and inherits the victim's authenticated identity, allowing them to read the victim's data and act as that victim against the backend. No public exploit code was referenced, and success depends on the opportunistic timing of a victim's authenticated session being available in the pool.