Summary
Traefik contains an authentication bypass in which a backend connection authenticated with an Authorization: Negotiate token can be reused by a different frontend connection.
When connection-pool isolation is insufficient, an unauthenticated attacker may be assigned a socket associated with another user's NTLM or Kerberos identity and perform backend reads or writes with that identity.
Traefik contains an authentication bypass in which a backend connection authenticated with an Authorization: Negotiate token can be reused by a different frontend connection.
When connection-pool isolation is insufficient, an unauthenticated attacker may be assigned a socket associated with another user's NTLM or Kerberos identity and perform backend reads or writes with that identity.
Affected context
The issue may affect Traefik deployments using versions in the affected 2.11.x or 3.x ranges with Negotiate-based authentication and a globally shared backend connection pool. Risk is higher when authenticated backend sockets remain reusable across separate frontend connections without binding the authenticated identity to the requesting session.
The issue may affect Traefik deployments using versions in the affected 2.11.x or 3.x ranges with Negotiate-based authentication and a globally shared backend connection pool. Risk is higher when authenticated backend sockets remain reusable across separate frontend connections without binding the authenticated identity to the requesting session.
Exploit preconditions
- Attack surface: Traefik frontend connections that forward requests through a shared backend connection pool
- Required access: Network access to an exposed Traefik entry point; valid victim credentials are not necessarily available to the attacker
- Trigger point: Assignment of a previously authenticated backend socket to a separate unauthenticated frontend connection
- Why exploitation is possible: The pool does not adequately isolate or revalidate sockets authenticated with NTLM or Kerberos identity information
- Attack surface: Traefik frontend connections that forward requests through a shared backend connection pool
- Required access: Network access to an exposed Traefik entry point; valid victim credentials are not necessarily available to the attacker
- Trigger point: Assignment of a previously authenticated backend socket to a separate unauthenticated frontend connection
- Why exploitation is possible: The pool does not adequately isolate or revalidate sockets authenticated with NTLM or Kerberos identity information
Why this happens
The vulnerability results from treating backend connection reuse as independent of authentication state. A socket authenticated through an Authorization: Negotiate exchange is placed in a globally shared pool without sufficient isolation from later frontend requests.
This can allow authentication context to cross connection boundaries, causing one request to inherit the identity associated with another user. The behavior maps to CWE-287: Improper Authentication, because the system accepts access based on an authentication state that is not correctly bound to the requesting connection or principal.
The vulnerability results from treating backend connection reuse as independent of authentication state. A socket authenticated through an Authorization: Negotiate exchange is placed in a globally shared pool without sufficient isolation from later frontend requests.
This can allow authentication context to cross connection boundaries, causing one request to inherit the identity associated with another user. The behavior maps to CWE-287: Improper Authentication, because the system accepts access based on an authentication state that is not correctly bound to the requesting connection or principal.
Potential impact
- An unauthenticated attacker could perform backend requests under another user's identity
- Protected resources may be read or modified
- Authorization decisions could be made for the wrong principal
- Application data could be altered or deleted
- Audit records may attribute attacker activity to the victim
- An unauthenticated attacker could perform backend requests under another user's identity
- Protected resources may be read or modified
- Authorization decisions could be made for the wrong principal
- Application data could be altered or deleted
- Audit records may attribute attacker activity to the victim
General mitigation guidance
Mitigation generally focuses on preserving authentication-context isolation throughout proxy connection management.
Defensive patterns include:
- Isolating pooled backend connections by authenticated principal and security context
- Preventing reuse of authentication-bound sockets across unrelated frontend sessions
- Revalidating identity and authorization state before assigning a pooled connection
- Disabling connection reuse where safe isolation cannot be guaranteed
- Applying least-privilege permissions to authenticated backend identities
- Monitoring and restricting Negotiate-based authentication paths to trusted contexts
- Using secure-by-default proxy and transport settings that do not share authenticated sessions across users
Mitigation generally focuses on preserving authentication-context isolation throughout proxy connection management.
Defensive patterns include:
- Isolating pooled backend connections by authenticated principal and security context
- Preventing reuse of authentication-bound sockets across unrelated frontend sessions
- Revalidating identity and authorization state before assigning a pooled connection
- Disabling connection reuse where safe isolation cannot be guaranteed
- Applying least-privilege permissions to authenticated backend identities
- Monitoring and restricting Negotiate-based authentication paths to trusted contexts
- Using secure-by-default proxy and transport settings that do not share authenticated sessions across users
How teams detect issues like this
Detection can include static and configuration analysis for globally shared connection pools combined with Negotiate, NTLM, or Kerberos authentication.
Code review should examine whether pooled sockets retain authentication state, whether connection reuse is keyed to the authenticated principal, and whether frontend identity is rechecked before forwarding requests. Runtime monitoring can look for unauthenticated clients receiving responses or authorization outcomes associated with authenticated users, unexpected cross-user writes, and mismatches between frontend credentials and backend audit identities. Policy enforcement can require explicit isolation rules for authentication-bound connections, with automated security review tools used to flag unsafe pooling patterns.
Detection can include static and configuration analysis for globally shared connection pools combined with Negotiate, NTLM, or Kerberos authentication.
Code review should examine whether pooled sockets retain authentication state, whether connection reuse is keyed to the authenticated principal, and whether frontend identity is rechecked before forwarding requests. Runtime monitoring can look for unauthenticated clients receiving responses or authorization outcomes associated with authenticated users, unexpected cross-user writes, and mismatches between frontend credentials and backend audit identities. Policy enforcement can require explicit isolation rules for authentication-bound connections, with automated security review tools used to flag unsafe pooling patterns.
