Vulnerability in Traefik
CVE-2026-114641
Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over one connection to orphan backend connections, break connection-bound authentication, or crash Traefik.
Vulnerability class: Race Condition
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-mhjw-hmjv-p99x (vendor-advisory)
- www.vulncheck.com/advisories/traefik-before-2.11.58-and-3.7.14-race-condition-i… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-114641?
- CVE-2026-114641 is a low-severity vulnerability in Traefik, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 3.7/10. Published 2026-10-22.
- How severe is CVE-2026-114641?
- Low severity. CVSS v3 base score is 3.7 out of 10.