A flaw in Traefik’s reverse proxy allows an attacker to inject a malicious HTTP/2 or HTTP/3 CONNECT request that is forwarded to an HTTP/1.1 upstream using a shared net/http.Transport. When the upstream answers the CONNECT with a keep‑alive non‑2xx response and does not drain the request body, the backend socket is returned to the shared pool and later reused by a different client. The attacker can then cause that client to read the smuggled response, which may contain authenticated or private data from the original requester. This is a classic case of cross‑user response poisoning (CWE‑444) and can lead to confidential data exposure without authentication.

Traefik HTTP reverse proxy versions prior to 2.11.53, 3.6.24 and 3.7.9 are affected. The vulnerability occurs when the default configuration forwards CONNECT methods to upstream services via a shared keep‑alive transport pool. Any deployment that uses these default settings with untrusted clients is at risk.

The CVSS score is 7, indicating a high severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the current exploitation probability is unknown, but the lack of authentication requirements and the ability to use the proxy’s shared backend pool make exploitation straightforward for an attacker who can control request traffic. The attack vector is likely an internal or supply‑chain attacker that can send CONNECT requests through the proxy. Attackers can gain access to sensitive data from other users’ sessions, which can compromise confidentiality and potentially impact integrated authentication mechanisms such as ForwardAuth if enabled.