CVE-2026-114637 traefik CVE debrief

Who should care

Defenders responsible for Traefik deployments, particularly those using the FastProxy feature, should assess exposure and apply patches or mitigations. This includes verifying Traefik version and exposure, focusing on systems using the FastProxy feature, and reviewing compensating controls for exposed systems. Security teams and vulnerability management teams should prioritize this vulnerability due to its high severity and potential impact on Traefik's 3.

Why it matters

CVE-2026-114637 is a high-severity authentication bypass vulnerability in Traefik's FastProxy connection pool. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent unauthenticated access to victim data and potential lateral movement within networks.

• Unauthenticated access to victim data
• Ability for attackers to act as victims
• Potential for lateral movement within networks
• Need for verification of Traefik version and exposure

Technical summary

The vulnerability is caused by the failure to pin NTLM/Negotiate-authenticated backend connections to their frontend connection in Traefik's experimental FastProxy connection pool. This allows unauthenticated clients to access victim data and act as the victim. The issue affects Traefik versions from 3.2.0 before 3.7.14, and defenders should prioritize verifying exposure and applying patches or mitigations, focusing on systems using Traefik's FastProxy feature. The CVE record provides details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations, focusing on systems using Traefik's FastProxy feature.

Recommended defensive actions

• Verify Traefik version and assess exposure
• Apply patches or mitigations for affected versions
• Monitor for suspicious activity on FastProxy connections
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Defenders should verify Traefik version and exposure, focusing on systems using the FastProxy feature. Evidence is limited to public CVE and NVD information, with no additional claims. Further verification is recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.