CVE-2026-114637

highpriority · track · 35EPSS 0.003 · 22 %ileUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (22nd) EPSS

CVSS 8.7 · high

Is it mine?

1 products

Check your exposure

Who says so?

1 sources

nvd

EPSS · scored 2026-10-27

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend connection where a victim completed an NTLM or Negotiate handshake, letting them read victim data and act as that victim.

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.7–8.7

v3.18.7highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:Nprimary · disclosure@vulncheck.comexploitability 2.2 · impact 5.8

v4.07highCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.02.7lowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-488USprimary

affected products (1)

Products and version ranges known to be affected.

traefik traefik3.2.0 → 3.7.14nvdUScpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*

sources

Which sources assert this record, and when.

nvd NVD CVE.org MITRE

published 2026-10-22modified 2026-10-27

related (54)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-38367US	critical9.6	11.1% (96th)	—	2024-07-01
trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification st…
CVE-2024-27935US	high8.3	0.72% (54th)	—	2024-03-21
Deno is a JavaScript, TypeScript, and WebAssembly runtime. Starting in version 1.35.1 and prior to version 1.36.3, a vulnerability in Deno's Node.js compatibility runtime allows fo…
CVE-2024-41977US	high8.0	0.44% (38th)	—	2024-08-13
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.…
CVE-2026-54311US	high7.7	0.39% (33rd)	—	2026-06-23
n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute the sandbox used b…
CVE-2022-40210US	high7.8	0.20% (9th)	—	2023-05-10
Exposure of data element to wrong session in the Intel DCM software before version 5.0.1 may allow an authenticated user to potentially enable escalation of privilege via local acc…

+49 more

references (2) nvd

External citations — patches, advisories, analysis.

https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35Vendor Advisory
https://www.vulncheck.com/advisories/traefik-3.2.0-before-3.7.14-fastproxy-ntlm-negotiate-connection-pool-identity-leakThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan