Traefik versions 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 contain a flaw where a client that presents an Authorization: Negotiate header establishes a socket that is stored in a globally shared backend connection pool. Subsequent unauthenticated connections to other frontends can obtain that socket and use it to read or write data as the original authenticated user. The result is an authentication bypass that permits impersonation and potentially data exfiltration or modification without knowing the victim’s credentials.

All installations of Traefik 2.11.0 up to but not including 2.11.58 and Traefik 3.0.0 up to but not including 3.7.14 are affected. The vulnerability applies to any deployment where NTLM or Kerberos authentication is enabled for frontends.

The CVSS severity score is 7, indicating a high risk level. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the attack requires only a standard HTTP(S) connection with a Negotiate token. An attacker who can initiate a Negotiate-authenticated request can subsequently use the vulnerable backend pool to act as the victim on any other frontend connection. Because the pool is globally shared, the can be performed from any location that can reach the Traefik instance, making it a realistic threat for exposed services.