ETK-2026-976

validated

GHSA-53qr-784g-cj35 ↗

check availablenot proven exploitable

awaiting cvepublic pockev

go:Traefik >= v3.2.0, <= v3.7.13

fixed in v3.7.14

CWE-488 Exposure of Data Element to Wrong Session

ETK-2026-976, no cve assigned

pkg:golang/Traefik

cvss7.0cna vendorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

−13dTTV

25mAI analysis

Check if you are vulnerable

timeline

0 = trigger signal

trigger signal +0dcheck available+1.2dagent stopped

+5d

+10d

+15d

description

Traefik deployments using experimental FastProxy can reuse an authenticated backend connection for a different client. An unauthenticated client may access data or perform operations under another user's backend identity when FastProxy fronts a keep-alive HTTP backend using connection-bound NTLM or Negotiate authentication.

mitigation

Upgrade Traefik to v3.7.14. Until upgraded, disable experimental FastProxy, especially for plain HTTP backends that use NTLM or Negotiate authentication.

fixed in v3.7.14

check

available

exploit

automation

deterministic

auth required

EPSS

–

agent run time

25m

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-07 08:47Z
ghsa: trigger signal, started the run
https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35

this entry in the feed

GET /api/v1/feed/ETK-2026-976

{
  "etk_id": "ETK-2026-976",
  "cve_id": null,
  "display_id": "ETK-2026-976",
  "ghsa_id": "GHSA-53qr-784g-cj35",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Connection-bound authentication mix-up in Traefik FastProxy",
  "summary": "Traefik deployments using experimental FastProxy can reuse an authenticated backend connection for a different client. An unauthenticated client may access data or perform operations under another user's backend identity when FastProxy fronts a keep-alive HTTP backend using connection-bound NTLM or Negotiate authentication.",
  "mitigation": "Upgrade Traefik to v3.7.14. Until upgraded, disable experimental FastProxy, especially for plain HTTP backends that use NTLM or Negotiate authentication.",
  "vendor": "go",
  "product": "go:Traefik",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v3.2.0, <= v3.7.13"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v3.7.14"
      ],
      "package_name": "Traefik",
      "purl": "pkg:golang/Traefik"
    }
  ],
  "cwes": [
    488
  ],
  "cvss_score": 7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 25.401682916666665,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-08T14:34:42.926621+00:00",
      "days": -13.275831365613426,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:11:54.779665+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-07T08:47:35+00:00",
      "days": -14.51689533113426,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T21:11:54.779665+00:00",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-53qr-784g-cj35"
    }
  }
}

published 2026-10-08 14:09Z
last change 2026-10-21 20:58Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.