Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin…
Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft
- Product
- Active Directory / Entra ID, Squid / HAProxy / Varnish
- CVSS
- 8.7
- EPSS
- 0.003 (p21)
- Exposure class
- Identity, Edge / VPN / firewall
Why it ranks 28 (Notable)
- CVSS 8.7 high
- Exposed product class: identity, edge / VPN / firewall
- Widely deployed vendor product (Microsoft)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-114637 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.