Authentication Bypass in Traefik by Containo

CVE-2026-114639

What is CVE-2026-114639?

Traefik versions 2.11.0 prior to 2.11.58 and 3.0.0 prior to 3.7.14 are susceptible to an authentication bypass vulnerability. This occurs when an initial request, authenticated with an Authorization: Negotiate token, compromises the globally shared backend connection pool. Attackers on separated frontend connections can exploit this flaw, obtaining access to the authenticated socket associated with a victim. Consequently, they can perform unauthorized read and write operations under the victim's identity, significantly jeopardizing the application's security.

References