Summary
Traefik can reuse one backend service's TLS client configuration for another service when NTLM or Negotiate authentication causes a connection slot to be populated incorrectly. An unauthenticated network client may exploit this behavior to bypass the second service's configured root CAs, server name checks, and certificate verification.
Traefik can reuse one backend service's TLS client configuration for another service when NTLM or Negotiate authentication causes a connection slot to be populated incorrectly. An unauthenticated network client may exploit this behavior to bypass the second service's configured root CAs, server name checks, and certificate verification.
Affected context
The issue affects Traefik deployments that route traffic to multiple backend services and use keep-alive connections with NTLM or Kerberos-based challenge handling. It becomes risky when connection state is shared without being keyed to the applicable ServersTransport configuration, allowing TLS settings from one backend to influence another backend connection.
The issue affects Traefik deployments that route traffic to multiple backend services and use keep-alive connections with NTLM or Kerberos-based challenge handling. It becomes risky when connection state is shared without being keyed to the applicable ServersTransport configuration, allowing TLS settings from one backend to influence another backend connection.
Exploit preconditions
- Attack surface: Network-reachable Traefik entry points and routed backend services
- Required access: Unauthenticated ability to send requests through the affected proxy
- Trigger point: A backend connection that produces an NTLM or Negotiate authentication challenge, followed by reuse of the same keep-alive connection for another service
- Why exploitation is possible: The round tripper is stored in a connection slot that is not scoped to ServersTransport, so certificate validation settings can cross service boundaries
- Attack surface: Network-reachable Traefik entry points and routed backend services
- Required access: Unauthenticated ability to send requests through the affected proxy
- Trigger point: A backend connection that produces an NTLM or Negotiate authentication challenge, followed by reuse of the same keep-alive connection for another service
- Why exploitation is possible: The round tripper is stored in a connection slot that is not scoped to ServersTransport, so certificate validation settings can cross service boundaries
Why this happens
The underlying bug is incorrect association of reusable client-connection state with backend TLS configuration. A round tripper created for one service can be reused for another because the connection slot is not keyed by the relevant ServersTransport settings.
This behavior maps to CWE-295: Improper Certificate Validation, because the affected backend connection may apply the wrong root CA set, server name, or certificate-verification policy when validating a remote certificate. As a result, a certificate that would not be trusted under the target service's configuration may be accepted.
The underlying bug is incorrect association of reusable client-connection state with backend TLS configuration. A round tripper created for one service can be reused for another because the connection slot is not keyed by the relevant ServersTransport settings.
This behavior maps to CWE-295: Improper Certificate Validation, because the affected backend connection may apply the wrong root CA set, server name, or certificate-verification policy when validating a remote certificate. As a result, a certificate that would not be trusted under the target service's configuration may be accepted.
Potential impact
- An attacker could bypass intended backend certificate verification
- Requests could be sent to an unintended or impersonating backend endpoint
- Backend confidentiality and integrity could be reduced
- Sensitive proxied data may be exposed to an unauthorized service
- Service isolation assumptions based on distinct TLS configurations may be undermined
- An attacker could bypass intended backend certificate verification
- Requests could be sent to an unintended or impersonating backend endpoint
- Backend confidentiality and integrity could be reduced
- Sensitive proxied data may be exposed to an unauthorized service
- Service isolation assumptions based on distinct TLS configurations may be undermined
General mitigation guidance
Mitigation generally focuses on preserving strict isolation between reusable connections and the TLS policies that govern them.
Common defensive patterns include:
- Keying connection pools and round trippers by all security-relevant transport settings
- Ensuring each backend service consistently uses its own root CAs, server name, and verification policy
- Avoiding connection reuse when transport identity or authentication state is ambiguous
- Keeping certificate verification enabled and rejecting trust-all configurations
- Limiting backend network reachability and applying least-privilege service-account permissions
- Testing challenge-based authentication flows across multiple services and transport configurations
Mitigation generally focuses on preserving strict isolation between reusable connections and the TLS policies that govern them.
Common defensive patterns include:
- Keying connection pools and round trippers by all security-relevant transport settings
- Ensuring each backend service consistently uses its own root CAs, server name, and verification policy
- Avoiding connection reuse when transport identity or authentication state is ambiguous
- Keeping certificate verification enabled and rejecting trust-all configurations
- Limiting backend network reachability and applying least-privilege service-account permissions
- Testing challenge-based authentication flows across multiple services and transport configurations
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of connection-pool and round-tripper caches for incomplete security-context keys
- Code review checks for shared transport state across distinct backend or tenant configurations
- Integration tests that use different CA bundles, server names, and verification policies on adjacent services
- Proxy and backend telemetry showing unexpected certificate subjects, trust roots, or destination changes
- Policy enforcement that prohibits disabled certificate verification except where explicitly justified
Automated security review tools may help identify shared connection state and unsafe certificate-validation patterns, but behavioral testing remains important for challenge-based authentication flows.
Organizations can look for this class of issue through:
- Static analysis of connection-pool and round-tripper caches for incomplete security-context keys
- Code review checks for shared transport state across distinct backend or tenant configurations
- Integration tests that use different CA bundles, server names, and verification policies on adjacent services
- Proxy and backend telemetry showing unexpected certificate subjects, trust roots, or destination changes
- Policy enforcement that prohibits disabled certificate verification except where explicitly justified
Automated security review tools may help identify shared connection state and unsafe certificate-validation patterns, but behavioral testing remains important for challenge-based authentication flows.
