Traefik HTTP/3 Backend NTLM Connection Reuse

Published September 10, 2026 CVE-2026-88007

A Traefik flaw can let one HTTP/3 user access backend data as another user. They may also perform actions under that user's identity.

Severity
CriticalCVSS 4.0 · 9.1
Fix
Fixed in 2.11.57Fix recorded today
Affected versions
2.11.0 or newer, but before 2.11.57; 3.0.0 or newer, but before 3.7.13
Weakness
CWE-287Improper Authentication
Exploit likelihood
0.37% in 30 daysEPSS, higher than 30% of known flaws
Affects
Traefik

How it works

  • A victim authenticates to a backend using NTLM or Negotiate authentication.
  • When HTTP/3 and backend keep-alive are enabled, Traefik can reuse the victim's authenticated backend connection for another client.
  • That client can then receive the victim's backend access without presenting the victim's credentials.

What to do

Compare the Traefik version on each HTTP/3 entrypoint with the affected ranges in the Traefik advisory. Confirm whether those routes use connection-bound NTLM or Negotiate authentication and backend keep-alive.

Update Traefik to 2.11.57 or 3.7.13, matching your release branch.

Technical details

CVE-2026-88007 affects Traefik's HTTP/3 path when backend identity remains tied to a persistent NTLM or Negotiate connection. The HTTP/3 entrypoint used shared backend transport state instead of isolating each client connection. Ordinary per-request authentication is not affected.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source