CVE-2026-114637
Description
A flaw was found in Traefik. The FastProxy connection pool fails to properly bind authenticated backend connections to their specific client sessions. An unauthenticated remote attacker can be assigned a reused connection previously authenticated by another user via NTLM (NT LAN Manager) or Negotiate protocols. This allows the attacker to bypass authentication, access sensitive user data, and impersonate the authenticated victim.
Statement
This vulnerability is rated as Important severity because an unauthenticated remote attacker could hijack an existing authenticated session and gain unauthorized access to backend services. Exploitation depends on the non-default use of the experimental FastProxy connection pool in conjunction with backend services that rely on connection-based NTLM or Negotiate authentication. Because this experimental capability is not enabled by default and Traefik is not distributed in Red Hat enterprise product offerings, typical deployments are not exposed to this risk.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
