CVE-2026-114642

{
  "etk_id": "ETK-2026-2390",
  "cve_id": "CVE-2026-114642",
  "display_id": "CVE-2026-114642",
  "ghsa_id": "GHSA-x4hj-7xc2-whmq",
  "euvd_id": "EUVD-2026-107897",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-service TLS validation bypass in Traefik",
  "summary": "Traefik versions 2.11.0 through 2.11.57 and 3.0.0 through 3.7.13 can apply one backend service's TLS client settings when connecting to another service. An unauthenticated requester may cause certificate and server-identity checks for a target backend to be bypassed when a persistent connection is shared and a backend can trigger NTLM or Negotiate authentication.",
  "mitigation": "Upgrade Traefik 2.11 deployments to 2.11.58 or later, or 3.x deployments to 3.7.14 or later. Until upgrading, reduce exposure by preventing untrusted access to routes that can reach backends using NTLM or Negotiate authentication.",
  "vendor": "traefik",
  "product": "traefik",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.11.0, < 2.11.58"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2.11.58"
      ],
      "package_name": "traefik",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, < 3.7.14"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.7.14"
      ],
      "package_name": "traefik",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 10.554430183333332,
  "t0_at": "2026-10-22T01:43:41.355000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T01:43:41.355000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T01:43:41.355000+00:00",
      "url": "https://github.com/advisories/GHSA-x4hj-7xc2-whmq"
    }
  }
}