Traefik 3.2.0 Before 3.7.14 Fastproxy Ntlm Negotiate Connection Pool Identity Leak

Back www.vulncheck.com

Traefik 3.2.0 Before 3.7.14 Fastproxy Ntlm Negotiate Connection Pool Identity Leak

www.vulncheck.com • October 22, 2026

Share: View original

Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak

traefik >= 3.2.0, = 3.2.0, < 3.7.14

CWE-488 Exposure of Data Element to Wrong Session

GitHub Security Advisory (GHSA-53qr-784g-cj35)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Traefik Vulnerabilities Discovered Before Version 3.7.14 Several vulnerabilities affecting Traefik versions prior to 3.7.14 have been disclosed, including TLS config bypass via NTLM/Kerberos round tripper, identity leaks in FastProxy, SNI check bypass via HTTP/2 scheme, MTLS bypass via negated host matcher, and MTLS header spoofing via Ingress Nginx HTTP router. These vulnerabilities impact Traefik versions 2.11.0 to 2.11.58 and 3.0.0 to 3.7.14. The issues are categorized under various CWEs, including improper certificate validation and exposure of data elements to wrong sessions. The vulnerabilities are currently, and no has been reported. Organizations using affected versions are advised to prioritize updates as they become available. 43

Extracted Entities

Attack Types (1)

Vulnerabilities (1)

GHSA-53qr-784g-cj35