Executive brief
Traefik is a reverse proxy and load balancer commonly used in containerized environments. When HTTP/3 is enabled, the proxy fails to properly isolate authentication sessions for backends using NTLM or Kerberos authentication tied to persistent TCP connections. An attacker can reuse a victim's authenticated backend connection without credentials, allowing unauthorized access to sensitive data and the ability to perform actions as the victim.
Technical details
The vulnerability is a protocol-parity bug in HTTP/3 connection context initialization. HTTP/1.1 and HTTP/2 properly call service.AddTransportOnContext() to create a per-connection transport holder for NTLM/Negotiate isolation, but the HTTP/3 handler in server_entrypoint_tcp_http3.go omits this call. When kerberosRoundTripper checks for the transportKey context value and finds it missing, it falls back to the shared OriginalRoundTripper. An attacker can then send an unauthenticated HTTP/3 request that reuses the same backend TCP connection a victim previously authenticated to via NTLM or Negotiate, inheriting the victim's credentials without sending authorization headers. The attack requires HTTP/3 to be enabled on the entrypoint, a routed backend using connection-bound NTLM/Negotiate auth, and backend connection reuse. Patches available in v2.11.57 and v3.7.13.
Affected products
- Traefik Traefik 2.11.0 to 2.11.56, 3.0.0 to 3.7.12
Timeline
- 2026-09-07: disclosed: Published on GitHub Advisory Database
- 2026-09-10: advisory: Advisory updated with additional details
- 2026-09-01: patched: Patches released in v2.11.57 and v3.7.13