# CVE-2026-114639: Traefik authentication bypass in backend connection pool

Source: https://junglewise.ai/threats/cve-2026-114639-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-contains  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114639 · Severity: high · CVSS 8.7 · Published 2026-10-22

Traefik is a reverse proxy and load balancer used to route web traffic to backend services. This vulnerability allows an unauthenticated attacker to impersonate a legitimate user and access or modify data by reusing an authenticated backend connection that was incorrectly placed in a shared pool. An attacker on a separate network connection can intercept this authenticated socket and perform actions with the victim's identity.

Technologies: [Traefik](https://junglewise.ai/threats/technologies/traefik). Vendors: [Traefik](https://junglewise.ai/threats/vendors/traefik).

## Quick answers

**Is CVE-2026-114639 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114639 being exploited in the wild.

**How severe is CVE-2026-114639?** High severity, with a CVSS score of 8.7, published 22 October 2026.

**Which products and versions are affected?** Traefik 2.11.0 to 2.11.57, 3.0.0 to 3.7.13.

**Is there a fix for CVE-2026-114639?** Yes: fixed in Traefik 2.11.58, 3.7.14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114639 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114639?** Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Traefik 2.11.58, 3.7.14

## Technical details

The vulnerability stems from improper isolation of backend connections when NTLM/Kerberos (Negotiate) authentication is used with connection reuse. When a client preauthenticates by sending an Authorization: Negotiate token on the first request, the backend socket becomes authenticated but remains in the globally shared connection pool instead of being isolated per frontend connection. An unauthenticated attacker on a separate frontend connection can be assigned this authenticated socket and perform authenticated operations. The issue affects HTTP/1.1 and HTTP/2 connections and requires the backend to support connection-bound NTLM/Negotiate authentication with reuse enabled.

## Affected products

- Traefik Traefik 2.11.0 to 2.11.57, 3.0.0 to 3.7.13

## Timeline

- 2026-10-07: disclosed
- 2026-10-22: patched

## References

- [https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh](https://github.com/traefik/traefik/security/advisories/GHSA-qm9f-w54v-q2qh)
- [https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-authentication-bypass-via-negotiate-connection-pool](https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-authentication-bypass-via-negotiate-connection-pool)

## Related threats

- [Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate](https://junglewise.ai/threats/cve-2026-121966-traefik-2-x-before-2-11-60-and-3-x-before-3-7-16-sends)
- [Traefik FastProxy data race in HTTP/1 upgrades](https://junglewise.ai/threats/cve-2026-119574-traefik-from-3-2-0-before-3-7-15-contains-a-data-race-in-the)
- [Traefik authentication bypass in TLS options resolution](https://junglewise.ai/threats/cve-2026-114656-traefik-before-2-11-58-and-3-7-13-contains-an-authentication)
- [Traefik NTLM/Kerberos TLS configuration bypass](https://junglewise.ai/threats/cve-2026-114642-traefik-2-11-0-before-2-11-58-and-3-0-0-before-3-7-14-stores-its)
- [Traefik Kubernetes Ingress missing namespace validation in annotations](https://junglewise.ai/threats/cve-2026-112778-traefik-before-2-11-46-3-x-before-3-6-17-and-3-7-0-lack)