Vulnerability Description
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Traefik | Traefik | >= 2.11.0, < 2.11.58 |
Related Weaknesses (CWE)
References
- https://github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99xVendor Advisory
- https://www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-race-condThird Party Advisory
FAQ
What is CVE-2026-114641?
CVE-2026-114641 is a vulnerability with a CVSS score of 3.7 (LOW). Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and wr...
How severe is CVE-2026-114641?
CVE-2026-114641 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114641?
Check the references section above for vendor advisories and patch information. Affected products include: Traefik Traefik.