Listen to this Post
Traefik’s HTTP/3 request path fails to initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate (Kerberos) authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend round-tripper, but its ConnContext never calls service.AddTransportOnContext. As a result, kerberosRoundTripper falls back to the shared backend transport instead of a per-frontend-connection pool. When a route is served over HTTP/3 to a backend that binds identity to a persistent connection via NTLM or Negotiate, an unrelated HTTP/3 client can be assigned a backend connection already authenticated as a victim. The attacker inherits that identity, reads victim-only data, and performs actions as the victim without presenting the victim’s credentials. Affected deployments require HTTP/3 enabled on the entrypoint, a backend using connection-bound NTLM/Negotiate authentication, and backend keep-alive. Deployments using ordinary per-request authentication are not affected. The issue is caused by a protocol-parity gap between the normal TCP HTTP entrypoint path and the HTTP/3 entrypoint path. For HTTP/1.1 and HTTP/2, Traefik explicitly creates a connection-scoped holder that can later store a dedicated RoundTripper for NTLM or Negotiate. That helper installs the per-connection holder, and kerberosRoundTripper depends on it. If the holder is absent, it falls back to the shared original backend transport. If NTLM or Negotiate is detected, it stores a dedicated cloned RoundTripper into that holder so future requests stay on the authenticated backend connection. For HTTP/3, the server reuses the normal HTTPS handler chain, but its ConnContext only propagates the TLS options name and does not call service.AddTransportOnContext. This means HTTP/3 requests reach the same reverse-proxy and backend transport logic as HTTPS, but without the connection-scoped transport holder that NTLM and Negotiate isolation relies on. A victim authenticates through Traefik to a backend that binds identity to the backend TCP connection using NTLM or Negotiate. Because the HTTP/3 request context does not contain transportKey, kerberosRoundTripper uses the shared OriginalRoundTripper. No frontend-connection-specific dedicated backend pool is installed for that HTTP/3 client. A second unrelated HTTP/3 client can be assigned the same backend TCP connection after the victim has authenticated it. That second client inherits the victim’s backend identity without sending the victim’s credentials. The attached verifier demonstrates both the negative control and the exploit path. The HTTPS/HTTP/1.1 control case behaves correctly and isolates the attacker. The HTTP/3 exploit case allows a second unauthenticated client to read victim-only data and execute a state-changing request as actor=victim. The attacker reads resource=secret actor=victim, executes action=transfer actor=victim to=attacker amount=5000, and hits the same backend TCP connection identifier as the victim. The vulnerability affects Traefik versions from 2.11.0 until 2.11.57 and 3.7.13. The issue is fixed in 2.11.57 and 3.7.13.
DailyCVE Form:
Platform: Traefik
Version: 2.11.0-2.11.56, 3.0.0-3.7.12
Vulnerability: HTTP/3 NTLM reuse
Severity: Critical
date: 2026-09-10
Prediction: 2026-09-04
What Undercode Say:
Analytics:
docker build -t traefik-poc .
docker run –rm traefik-poc
PRODUCT_COMMIT=f2d0794417e4d06343e6e7c4722143f5b34bee45 ./run.sh
curl –http3 https://target/transfer?to=attacker&amount=5000
Exploit: (Educational Purposes!)
./run.sh
Expected terminal result: REPRODUCED: HTTP/1.1 isolates the authenticated backend connection, but HTTP/3 reuses the victim-authenticated backend connection for a different client and executes an unauthorized state-changing request as the victim.
Protection:
Upgrade to Traefik v2.11.57 or later for v2 series. Upgrade to Traefik v3.7.13 or later for v3 series. Disable HTTP/3 on entrypoints if not required. Avoid connection-bound NTLM/Negotiate backends with HTTP/3. Disable backend keep-alive if HTTP/3 must remain enabled.
Impact:
Cross-client authorization bypass. Unauthenticated second client reads victim-only data. Unauthenticated second client performs state-changing actions as victim. Attacker reuses backend TCP connection authenticated as victim. Prerequisites: HTTP/3 enabled, connection-bound NTLM/Negotiate backend, backend keep-alive, attacker reachable to same route.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
