CVE-2026-114642
Description
A flaw was found in Traefik. An unauthenticated remote attacker can bypass Transport Layer Security (TLS) certificate verification and security controls for backend services. Due to improper connection handling during authentication challenges, Traefik reuses one service's TLS configuration for subsequent requests sent to a different service over the same persistent connection. This flaw allows an attacker to communicate with protected backend services while circumventing intended certificate and identity checks.
Statement
This vulnerability is rated as having an Important impact because an unauthenticated remote adversary can circumvent backend TLS certificate validation and reach isolated upstream targets across shared connections. While exploitation demands specific conditions—specifically a backend issuing NTLM or Negotiate authentication challenges over persistent HTTP sessions—the blast radius compromises trust isolation between distinct backend endpoints. Traefik is not distributed or enabled in standard Red Hat Enterprise Linux or OpenShift environments.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
