Technical impact
This vulnerability allows an unauthenticated client to receive a backend connection that has already completed an NTLM or Negotiate authentication handshake. The experimental FastProxy connection pool fails to bind the authenticated state to the front‑end request, enabling the attacker to read data or act as the authenticated victim. The weakness is classified as CWE‑488, an authentication bypass flaw exposing sensitive information. Based on the description, the likely attack vector is a remote HTTP or HTTPS request to the Traefik front‑end that triggers an NTLM or Negotiate handshake with a protected backend.
Affected Systems
Traefik 3.2.0 through 3.7.13, as identified by the vendor package name traefik:traefik and the corresponding CPE string. Any deployment using the experimental FastProxy feature within these versions is potentially impacted.
Risk and Exploitability
The CVSS score of 7 indicates high severity. The EPSS score is not available, but because the vulnerability is not listed in CISA’s KEV catalog and the flaw involves a remote bypass via a public web interface, the chance of exploitation could be moderate to high, especially in environments where NTLM/Negotiate authentication is common. An attacker could exploit the weakness by sending unauthenticated requests to the front‑end and reusing pooled keep‑alive connections to hijack the victim’s back‑end session.
