CVE-2026-114642 Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper

What is CVE-2026-114642?

CVE-2026-114642 is a high-severity vulnerability in Traefik Traefik, published on 22 Oct 2026.

Official description

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

Weakness: CWE-295

Which versions are affected by CVE-2026-114642?

It affects 1 product.

Products include Traefik Traefik.

How do I fix CVE-2026-114642?

Upgrade to a fixed version.

Is CVE-2026-114642 being exploited?

There is no known exploitation of CVE-2026-114642 in the wild and no public exploit code.

Other vulnerabilities in Traefik Traefik

• CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik Critical 9.8
• CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect Critical 9.3
• CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth Critical 9.3
• CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse Critical 9.1
• CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging High 8.8

All Traefik Traefik vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as GHSA-cw35-4q88-3rmp, GHSA-x4hj-7xc2-whmq.