Traefik EUVD-2026-107896

Exploitation requires Traefik to be configured with NTLM or Kerberos (Negotiate) backend authentication - this is the specific, non-default feature that creates the vulnerable per-connection sticky round tripper slot. The attacker must also be able to send multiple concurrent requests multiplexed over a single HTTP/2 or HTTP/3 connection to the proxy. Limiting factors: the flaw is reachable without authentication (PR:N) but is gated by HIGH attack complexity and a present attack requirement (AC:H/AT:P), meaning the attacker must reliably win a timing-dependent race; deployments that do not use Negotiate backend auth, or that only use HTTP/1.1, are not exploitable. Impact is confined to availability/connection-integrity (DoS, orphaned connections, broken connection-bound auth) with no data confidentiality or integrity exposure.

This is a moderate, availability-focused issue rather than a top-tier emergency. The official CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw but with HIGH attack complexity and a present attack requirement (AT:P), reflecting the difficulty of reliably winning a race condition (CWE-362). Impact is limited to availability (VA:L; VC:N/VI:N) - orphaned backend connections, broken connection-bound authentication, or a Traefik crash - with no confidentiality or integrity impact, consistent with the 6.3 (Medium) score and the Denial Of Service / Race Condition tags. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Crucially, exploitation is gated on a non-default deployment: Traefik must be configured to use NTLM or Kerberos (Negotiate) backend authentication, which materially narrows the exploitable population below Traefik's overall footprint. Net: a real but conditional DoS/auth-bypass concern worth patching on affected proxies, not a widespread drive-by critical. Signals are internally consistent (network vector, high complexity, availability-only, config-dependent); no contradictions detected, though the absence of EPSS/KEV/POC data means real-world exploitation likelihood is inferred, not measured.

An attacker who can reach a Traefik instance configured with NTLM or Kerberos (Negotiate) backend authentication opens a single HTTP/2 or HTTP/3 connection and floods it with concurrent requests, racing the unsynchronized per-connection sticky round tripper slot. Winning the race orphans backend connections, breaks connection-bound authentication for legitimate users, or crashes the Traefik process, causing a denial of service. No public exploit code is identified at time of analysis, and the HIGH attack complexity means reliable triggering requires repeated attempts and favorable timing.