Traefik CVE-2026-114639

Exploitation requires that Traefik be proxying to a backend that uses connection-bound authentication via the Authorization: Negotiate scheme (NTLM or Kerberos), and that at least one legitimate victim has an active preauthenticated socket present in Traefik's globally shared backend connection pool at the time of attack. The attacker must be able to reach a Traefik frontend on a separate connection and have their request routed onto the victim's pooled socket. LIMITING FACTORS: this is NOT a default-configuration flaw against arbitrary Traefik deployments - it only affects setups fronting NTLM/Kerberos connection-authenticated backends; exploitation reliability depends on concurrent victim authentication and connection-pool reuse timing (reflected as AT:P in the CVSS 4.0 vector); no attacker authentication or user interaction is required (PR:N/UI:N). Deployments whose backends use request-scoped or tokenless auth are not affected.

This is a credible, mid-to-high priority issue for a specific class of deployments rather than a universal emergency. The CVSS 4.0 base score of 7.0 (AV:N/AC:L/AT:P/PR:N/UI:N) correctly captures that exploitation is network-reachable and requires no attacker privileges or user interaction, but carries AT:P - a real attack requirement: a legitimate victim must first establish an Authorization: Negotiate (NTLM/Kerberos) preauthenticated socket in the shared backend pool before an unauthenticated attacker can be assigned it. The impact metrics are notable: the vulnerable system itself shows VC:N/VI:N/VA:N, while the SUBSEQUENT system (the proxied backend) shows SC:H/SI:H - meaning the damage lands on the backend application, where the attacker reads or writes as the victim identity. No EPSS score was provided, this CVE is NOT in CISA KEV, and no public exploit was supplied in the intelligence, so there is no public exploit identified at time of analysis. The combination of a plausible but non-trivial precondition (an active preauthenticated backend connection) and absence of known exploitation suggests elevated but not critical urgency. Note one signal to verify: the AT:P requirement and the shared-pool race condition mean real-world reliability of exploitation depends on connection-pool timing and concurrent victim traffic, which the CVSS base score does not fully convey - confirm the backend authentication mode with your deployment before treating this as trivially exploitable.

An organization runs Traefik in front of a backend (e.g., an internal web app or API) that uses connection-oriented NTLM/Kerberos authentication via Authorization: Negotiate. A legitimate user authenticates, binding their identity to a socket that Traefik places in its globally shared, never-isolated backend connection pool. An unauthenticated attacker on a separate frontend connection then sends requests that get routed over that same bound socket and are processed by the backend with the victim's identity, allowing reads or writes as the victim. No public exploit code was identified in the provided intelligence.