Read the docs
TI-2026-79154 Aliases CVE-2026-114642GHSA-x4hj-7xc2-whmq

Traefik lets one service bypass another's TLS certificate checks

Priority LOW 30CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 reuses one service's TLS client configuration for another service's backend, because the NTLM/Kerberos round tripper is stored in a connection slot not keyed by ServersTransport. This flaw is classified as CWE-295 and lets an unauthenticated remote attacker bypass root CA, server name and certificate verification. The attacker makes a backend issue an NTLM or Negotiate challenge, then reaches another service over the same keep-alive connection.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 8th percentileScored 2026-11-07
Fix Fixed traefik (traefik): 2.11.58, 3.7.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
traefiktraefik2.11.0 to before 2.11.582.11.58Patch availableCNA
traefiktraefik3.0.0 to before 3.7.143.7.14Patch availableCNA
  • traefik Vendortraefik Affected 2.11.0 to before 2.11.58 Fixed in 2.11.58 Patch available CNA
  • traefik Vendortraefik Affected 3.0.0 to before 3.7.14 Fixed in 3.7.14 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*2.11.0 to before 2.11.58; 3.0.0 to before 3.7.14Vulnerabletraefik
  • cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions 2.11.0 to before 2.11.58; 3.0.0 to before 3.7.14 Vulnerable ·traefik

Remediation

Upgrade Traefik to 2.11.58 or 3.7.14, the fixed versions for the affected releases.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA traefik (traefik) Fixed in 2.11.58
  • Fix · CNA traefik (traefik) Fixed in 3.7.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    traefik 3.7.14

    8 records Highest priority Priority LOW 8 LOW

    Other records, highest priority first

    • TI-2026-79151 Authentication bypass in Traefik via shared Negotiate connection poolPriority LOW 33
    • TI-2026-79149 Authentication bypass in Traefik FastProxy connection poolPriority LOW 33
    • TI-2026-79152 Traefik Ingress-NGINX provider lets attackers spoof mTLS client headersPriority LOW 32
    Show all 8 records →
  • Release ·

    traefik 2.11.58

    5 records Highest priority Priority LOW 5 LOW

    Other records, highest priority first

    • TI-2026-79151 Authentication bypass in Traefik via shared Negotiate connection poolPriority LOW 33
    • TI-2026-79147 Authentication bypass in Traefik SNI check via HTTP/2 schemePriority LOW 32
    • TI-2026-79155 Authentication bypass in Traefik lets clients skip mTLS checksPriority LOW 29
    Show all 5 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-22 Threatist record created from CVE-2026-114642
  2. 2026-10-22 Alias added: GHSA-x4hj-7xc2-whmq
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-23 CISA SSVC decision points changed
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
  • TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
  • TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
  • TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
  • TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences