CVE-2026-114641

Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper

State: Published
Severity: 6.3 Medium
Published: Oct 22, 2026
Updated: Oct 28, 2026
Reserved: Oct 21, 2026

Description

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	VulnCheck
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L	VulnCheck

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
traefiktraefik	2.11.0 to before 2.11.58Affected 2.11.58Not affected
traefiktraefik	3.0.0 to before 3.7.14Affected 3.7.14Not affected

References

GitHub Security Advisory (GHSA-mhjw-hmjv-p99x)vendor-advisory
VulnCheck Advisory: Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripperthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.