CVE-2026-114642

HighCVSS 8.7/10Last modified Oct 23, 2026

Description

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for another service's backend. An unauthenticated client can arm the slot via a backend issuing an NTLM or Negotiate challenge, then reach another service on the same keep-alive connection, bypassing its root CAs, server name, and certificate verification.

Metrics

CVSS 3.1 8.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
traefiktraefik>= 2.11.0, < 2.11.58
traefiktraefik>= 3.0.0, < 3.7.14

References

Timeline

Published
Oct 22, 2026
Last modified
Oct 23, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1146435.4The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type aCVE-2026-1146445.9The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON valuCVE-2026-1146455.2A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to CVE-2026-1146466.5A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a CVE-2026-1146474.3The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlikCVE-2026-1146487.6The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINCVE-2026-1146496.8The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached cCVE-2026-114653.1A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the filCVE-2026-1146505.9A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption CVE-2026-1146514.0A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processedCVE-2026-1146526.5A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supCVE-2026-1146536.5A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position tha