Race Condition in Traefik's NTLM and Kerberos Authentication
CVE-2026-114641

6.3MEDIUM

Key Information:

Vendor

Traefik

Status
Traefik
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114641?

Traefik versions 2.11.x prior to 2.11.58 and 3.x prior to 3.7.14 are susceptible to a race condition in NTLM and Kerberos backend authentication processes. This flaw allows remote attackers to send concurrent HTTP/2 or HTTP/3 requests over a single connection, leading to potential orphaning of backend connections, disruption of connection-bound authentication mechanisms, or even crashing the Traefik server. Proper synchronization is essential to mitigate these risks and maintain secure operations.

Affected Version(s)

traefik 2.11.0 < 2.11.58

traefik 3.0.0 < 3.7.14

traefik 2.11.58

References

https://github.com/traefik/traefik/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/traefik-before-2.11....
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.