CVE-2026-114639
Description
A flaw was found in Traefik. When a user authenticates to a backend service using an HTTP Negotiate authorization token, Traefik places the authenticated connection into a globally shared connection pool without isolating it. A remote, unauthenticated attacker connecting on a separate session can be assigned this reused connection, bypassing authentication. This flaw allows the attacker to read or modify backend resources using the victim's identity.
Statement
This vulnerability is rated as Important because remote unauthenticated actors can hijack pre-authenticated backend sessions, resulting in significant confidentiality and integrity impact on upstream applications. Successful exploitation requires specific timing and is constrained to environments where upstream endpoints use connection-oriented Negotiate authentication. Red Hat products do not deploy Traefik by default, as standard platforms rely on alternative routing technologies such as HAProxy, significantly reducing exposure across default installations.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
