TLS Configuration Bypass in Traefik by an Unauthenticated Client

CVE-2026-114642

What is CVE-2026-114642?

The vulnerability in Traefik allows an unauthenticated client to exploit the improper handling of the NTLM/Kerberos backend round tripper. This misconfiguration stores TLS client settings in a shared connection slot, leading to potential unauthorized access. By triggering a backend NTLM or Negotiate challenge, an attacker can use an established keep-alive connection to bypass critical certificate validations and reach other services, making this a significant risk for applications relying on this infrastructure.

References