CVE-2026-88007

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary

• Repository: traefik/traefik
• Commit: f2d0794417e4d06343e6e7c4722143f5b34bee45
• Validation time: 2026-08-25T06:48:02Z
• Commit time: 2026-08-24T08:26:06Z
• Patched status: not evaluated

Details

// pkg/server/server entrypoint tcp.go:691-703
var connContext multipleConnContext
connContext.AddConnContextFunc(func(ctx context.Context, c net.Conn) context.Context {
	// This adds an empty struct in order to store a RoundTripper in the ConnContext in case of Kerberos or NTLM.
	ctx = service.AddTransportOnContext(ctx)

	if tlsConn, ok := c.(*tls.Conn); ok {
		if tlsConnWithOptionsName, ok := tlsConn.NetConn().(tcp.TLSConn); ok {
			return tcp.AddTLSOptionsNameInContext(ctx, tlsConnWithOptionsName.TLSOptionsName)
		}
	}

	return ctx
})

// pkg/server/service/transport.go:374-402
func AddTransportOnContext(ctx context.Context) context.Context {
	return context.WithValue(ctx, transportKey, &stickyRoundTripper{})
}

type kerberosRoundTripper struct {
	new         func() http.RoundTripper
	OriginalRoundTripper http.RoundTripper
}

func (k *kerberosRoundTripper) RoundTrip(request *http.Request) (*http.Response, error) {
	value, ok := request.Context().Value(transportKey).(*stickyRoundTripper)
	if !ok {
		return k.OriginalRoundTripper.RoundTrip(request)
	}

	if value.RoundTripper != nil {
		return value.RoundTripper.RoundTrip(request)
	}

	resp, err := k.OriginalRoundTripper.RoundTrip(request)

	// If we found that we are authenticating with Kerberos (Negotiate) or NTLM.
	// We put a dedicated roundTripper in the ConnContext.
	// This will stick the next calls to the same connection with the backend.
	if err == nil && containsNTLMorNegotiate(resp.Header.Values("WWW-Authenticate")) {
		value.RoundTripper = k.new()
	}
	return resp, err
}

// pkg/server/server entrypoint tcp http3.go:65-80
h3.Server = &http3.Server{
	Addr:   config.GetAddress(),
	Port:   config.HTTP3.AdvertisedPort,
	Handler:  httpsServer.Server.(*http.Server).Handler,
	TLSConfig: &tls.Config{GetConfigForClient: h3.getTLSConfigForClient},
	QUICConfig: &quic.Config{
		Allow0RTT: false,
	},
	ConnContext: func(ctx context.Context, c *quic.Conn) context.Context {
		tlsOptionsName, err := h3.getTLSOptionsName(c)
		if err != nil {
			log.Error().Msgf("Error getting TLS options name for client: %v", err)
			return ctx
		}
		return tcp.AddTLSOptionsNameInContext(ctx, tlsOptionsName)
	},
}

1. A victim authenticates through Traefik to a backend that binds identity to the backend TCP connection using NTLM or Negotiate.
2. Because the HTTP/3 request context does not contain transportKey, kerberosRoundTripper uses the shared OriginalRoundTripper.
3. No frontend-connection-specific dedicated backend pool is installed for that HTTP/3 client.
4. A second unrelated HTTP/3 client can be assigned the same backend TCP connection after the victim has authenticated it.
5. That second client inherits the victim's backend identity without sending the victim's credentials.

• HTTPS/HTTP/1.1 control case: the attacker uses a separate frontend connection and correctly receives 401
• HTTP/3 exploit case: the attacker uses a separate HTTP/3 client with no Authorization header, reads resource=secret actor=victim, executes action=transfer actor=victim to=attacker amount=5000, and hits the same backend TCP connection identifier as the victim

PoC

• run.sh
• Dockerfile
• .dockerignore
• go.mod
• go.sum
• verify.go

1. run.sh builds a local image for the pinned target commit
2. the Dockerfile builds both Traefik and the verifier during image build
3. the container runs the verifier directly as its entrypoint
4. the verifier starts a synthetic backend, launches Traefik, runs the HTTPS/HTTP/1.1 control case, then runs the HTTP/3 exploit case

./run.sh

PRODUCT COMMIT=f2d0794417e4d06343e6e7c4722143f5b34bee45 ./run.sh

REPRODUCED: HTTP/1.1 isolates the authenticated backend connection, but HTTP/3 reuses the victim-authenticated backend connection for a different client and executes an unauthorized state-changing request as the victim.

• the HTTP/1.1 control case succeeds only if a fresh attacker connection receives 401
• the HTTP/3 exploit case succeeds only if the attacker reads victim-only data without sending Authorization
• the HTTP/3 exploit case succeeds only if the attacker performs /transfer?to=attacker&amount=5000 as actor=victim
• the HTTP/3 exploit case succeeds only if the attacker uses the same backend TCP connection identifier as the victim

• Docker is required
• the build fetches the target Traefik source from GitHub
• no production credentials or external NTLM service are required; the verifier includes a synthetic NTLM-like backend specifically to demonstrate connection-bound identity reuse

Impact

• read victim-only data
• perform a state-changing action as the victim
• reuse a backend TCP connection that has already been authenticated as the victim

• HTTP/3 enabled on the Traefik entrypoint
• a routed backend using connection-bound NTLM or Negotiate authentication
• backend keep-alive and backend connection reuse enabled
• the attacker can reach the same route as the victim