EUVD-2026-75544
GHSA-qqjf-53cj-pwvv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attacker (PR:N), but AC:H reflects the required HTTP/3 + connection-bound NTLM/keep-alive setup and the race to inherit a victim's live authenticated connection; high C/I from impersonation, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.
AnalysisAI
Backend connection hijacking in Traefik reverse proxy (2.11.0 through 2.11.56 and 3.0.0 through 3.7.12) lets an unauthenticated remote client impersonate another user over HTTP/3. Because the HTTP/3 entrypoint never calls service.AddTransportOnContext, the kerberosRoundTripper falls back to a shared backend transport instead of one bound to each frontend connection, so when a backend uses connection-bound NTLM or Negotiate authentication with keep-alive, an unrelated client can reuse a backend connection already authenticated for a victim, read the victim's data, and act as the victim without ever obtaining their credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be true simultaneously: the target Traefik entrypoint must have HTTP/3 enabled; the backend service must use connection-bound authentication (NTLM or Negotiate/Kerberos, which the KerberosRoundTripper handles); and backend keep-alive must be active so the authenticated connection persists for reuse. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.1) captures the shape well: network-reachable, no privileges, no user interaction, but AT:P reflects that a specific attack requirement (racing to inherit a victim's authenticated keep-alive backend connection) must be met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Traefik 2.11.57 (https://github.com/traefik/traefik/releases/tag/v2.11.57) or 3.7.13 (https://github.com/traefik/traefik/releases/tag/v3.7.13), which add the missing service.AddTransportOnContext call to the HTTP/3 entrypoint so each frontend connection again gets a dedicated backend transport. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Traefik deployments and identify instances running versions 2.11.0-2.11.56 or 3.0.0-3.7.12; as interim mitigation, disable HTTP/3 protocol support on affected instances if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a r
Route-level authentication bypass in Traefik v3.7.0-v3.7.7 allows unauthenticated remote attackers to reach backend endp
Traefik is an open source HTTP reverse proxy and load balancer. Rated high severity (CVSS 7.5), this vulnerability is re
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable
Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated net
Traefik's header-security defenses (aliasHeadersStrategy, underscoreHeadersStrategy, forwardedHeaders) inspect req.Heade
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Traefik is an open source HTTP reverse proxy and load balancer. Rated medium severity (CVSS 6.5), this vulnerability is
Authentication bypass in Traefik v3.7.0 through v3.7.11 lets remote unauthenticated attackers reach protected Kubernetes
Authentication bypass in Traefik reverse proxy before v2.11.55 lets remote unauthenticated attackers defeat any route pr
Namespace confusion in Traefik's Kubernetes Gateway API provider (versions 3.7.0-3.7.6) enables a low-privileged route a
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today