Is CVE-2026-114639 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114639 being exploited in the wild.

How severe is CVE-2026-114639?

High severity, with a CVSS score of 8.7, published 22 October 2026.

Which products and versions are affected?

Traefik 2.11.0 to 2.11.57, 3.0.0 to 3.7.13.

Is there a fix for CVE-2026-114639?

Yes: fixed in Traefik 2.11.58, 3.7.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114639 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114639?

Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114639: Traefik authentication bypass in backend connection pool

CVE-2026-114639 · Severity: high · CVSS 8.7 · Published 2026-10-22

Traefik is a reverse proxy and load balancer used to route web traffic to backend services. This vulnerability allows an unauthenticated attacker to impersonate a legitimate user and access or modify data by reusing an authenticated backend connection that was incorrectly placed in a shared pool. An attacker on a separate network connection can intercept this authenticated socket and perform actions with the victim's identity.

Technologies: Traefik. Vendors: Traefik.

Quick answers

Is CVE-2026-114639 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114639 being exploited in the wild.
How severe is CVE-2026-114639?: High severity, with a CVSS score of 8.7, published 22 October 2026.
Which products and versions are affected?: Traefik 2.11.0 to 2.11.57, 3.0.0 to 3.7.13.
Is there a fix for CVE-2026-114639?: Yes: fixed in Traefik 2.11.58, 3.7.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114639 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114639?: Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Traefik 2.11.58, 3.7.14

Technical details

The vulnerability stems from improper isolation of backend connections when NTLM/Kerberos (Negotiate) authentication is used with connection reuse. When a client preauthenticates by sending an Authorization: Negotiate token on the first request, the backend socket becomes authenticated but remains in the globally shared connection pool instead of being isolated per frontend connection. An unauthenticated attacker on a separate frontend connection can be assigned this authenticated socket and perform authenticated operations. The issue affects HTTP/1.1 and HTTP/2 connections and requires the backend to support connection-bound NTLM/Negotiate authentication with reuse enabled.

Affected products

Traefik Traefik 2.11.0 to 2.11.57, 3.0.0 to 3.7.13

Timeline

2026-10-07: disclosed
2026-10-22: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.