CyberRota Analysis
AI-GeneratedTraefik versions 2.11.0 to 2.11.57 and 3.7.13 are vulnerable due to improper handling of HTTP/3 connections, allowing an attacker to exploit shared backend transports to impersonate authenticated users and access sensitive data. This critical vulnerability poses a significant risk for environments utilizing connection-bound NTLM or Negotiate authentication with HTTP/3 enabled. Organizations using affected Traefik versions should prioritize immediate updates to the patched versions to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.0 until 2.11.57 and 3.7.13, the HTTP/3 entrypoint ConnContext does not call service.AddTransportOnContext, so kerberosRoundTripper uses a shared backend transport instead of a transport dedicated to each frontend connection. With HTTP/3 enabled, a backend using connection-bound NTLM or Negotiate authentication, and backend keep-alive, an unrelated client can reuse a backend connection authenticated for a victim, read victim-only data, and act as that victim without the victim credentials. This issue is fixed in 2.11.57 and 3.7.13.