Traefik’s HTTP/3 entrypoint missed a critical call to service.AddTransportOnContext, causing the kerberized round‑tripper to reuse a shared backend transport instead of creating one per client connection. Attackers with a separate client can therefore hijack a backend connection that has already been authenticated for a victim. By reusing that connection, the attacker can read data that was intended only for the victim and act with the victim’s privileges, all without the victim’s credentials. This flaw is an example of authentication bypass and improper isolation of per‑connection transport resources.

The issue affects Traefik releases 2.11.0 through 2.11.57 and the 3.7.13 build. Any installations within those version ranges that expose an HTTP/3 entrypoint to a backend using connection‑bound NTLM or Negotiate authentication with keep‑alive are vulnerable. Those can be mitigated by updating to the fixed releases 2.11.57 or 3.7.13 or newer.

The CVSS score of 9.1 indicates a critical impact. EPSS data is not available, so the current exploitation probability cannot be precisely quantified, but the flaw is not listed in the CISA KEV catalog, meaning it has not yet been confirmed as a known public exploit. Inferred from the description, the likely attack vector is remote: an attacker can use any HTTP/3 client that connects to the vulnerable entrypoint, provided the backend uses NTLM/Negotiate authentication with keep‑alive. The exploitation only requires the ability to send traffic to the Traefik instance; no privileged local access is required.