Advisory · CVE-2026-114637
Traefik experimental FastProxy pool can hand an NTLM-authenticated backend connection to an unauthenticated client
Traefik from 3.2.0 before 3.7.14, when experimental FastProxy is enabled, pools plain HTTP backend connections without pinning NTLM or Negotiate authenticated connections to their frontend connection, so an unauthenticated client can be served as a victim on a reused backend connection. CVSS 3.1 8.7.
- Vendor
- Traefik
- Product
- Traefik
- Identifier / CWE
- CVE-2026-114637
CWE-488 - Action timing
- Immediate
Explain it like I’m five
FastProxy keeps backend connections in a shared pool like taxis at a rank. If a passenger already proved who they are inside one taxi, the next stranger who gets that taxi is treated as them.
- 01Victim authenticates to a backend
A victim completes an NTLM or Negotiate handshake with a plain HTTP backend through Traefik with experimental FastProxy enabled, on a keep-alive connection.
- 02Connection returns to the FastProxy pool
Per Traefik, the FastProxy pool was keyed only by ServersTransport and target URL and did not apply the isolation the default proxy applies.
- 03Unauthenticated client is assigned it
An unauthenticated client on a brand-new frontend connection can be handed that pooled backend connection.
- 04Client is served as the victim
The client reads victim-only data and performs actions in the victim name without presenting any credentials, per the Traefik advisory.
What happened
Traefik disclosed CVE-2026-114637 in its GitHub security advisory: Traefik isolates connection-bound NTLM and Negotiate backend authentication by pinning the backend connection on which a client authenticated to that client frontend connection, but when experimental FastProxy is enabled, requests to plain HTTP backends are dispatched through FastProxy own connection pool, which was keyed only by ServersTransport and target URL and did not apply that isolation. Traefik states that against a backend that binds an identity to a persistent connection, an unauthenticated client could be handed a backend connection on which a victim had completed an NTLM or Negotiate handshake and be served as that victim. The CVSS 3.1 score is 8.7, with changed scope.
Per Traefik, affected deployments require experimental FastProxy enabled, a plain HTTP backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive; the default proxy implementation is not affected. FastProxy was introduced in v3.2: v3.2 through v3.6 are affected but no longer maintained and will not receive a patch of their own, so users on those lines must upgrade to v3.7.14, which is the patched release. Traefik v2 and earlier v3 versions are not affected. Traefik states FastProxy now dispatches requests carrying an NTLM or Negotiate credential through a pool dedicated to their frontend connection.
What to do
- Inventory Traefik deployments from 3.2.0 before 3.7.14 and check whether experimental FastProxy is enabled and whether any plain HTTP backends use NTLM or Negotiate authentication with keep-alive.
- Upgrade affected deployments to Traefik 3.7.14; deployments on the unmaintained 3.2 to 3.6 lines must move to 3.7.14 rather than waiting for a line patch.
- Until upgraded, disable experimental FastProxy on deployments that proxy NTLM or Negotiate backends, or disable backend keep-alive for those services.
- Hunt for backend requests where the authenticated identity does not match the frontend connection history, especially reads or actions by sensitive accounts from new client connections.
- Verify the deployed version and FastProxy configuration on every Traefik instance after updating.
Management note
Experimental features that change connection handling deserve production suspicion, and this one breaks the identity pinning the default proxy guarantees. If FastProxy is on anywhere near an NTLM backend, upgrade or turn it off today.