Traefik HTTP/3 Path Skips NTLM/Negotiate Connection Isolation, Enabling Cross-Client Identity Reuse

What happened

A GitHub Security Advisory (GHSA-qqjf-53cj-pwvv, tracked as CVE-2026-88007) reports that Traefik's HTTP/3 entrypoint does not initialize the connection-scoped transport holder that Traefik uses to isolate backend connections authenticated via NTLM or Negotiate (Kerberos) on the HTTP/1.1 and HTTP/2 paths. According to the advisory, the HTTP/3 handler reuses the HTTPS handler chain but its ConnContext never calls service.AddTransportOnContext, so kerberosRoundTripper falls back to the shared backend transport instead of a per-frontend-connection pool. A published proof-of-concept reportedly demonstrates an unauthenticated second HTTP/3 client reusing a victim-authenticated backend TCP connection to read victim-only data and execute a state-changing request as the victim, while the equivalent HTTP/1.1 control case correctly returns 401. Fixes are available in Traefik v2.11.57 and v3.7.13.

Why it matters

This is a cross-client authorization bypass, not a typical injection or RCE bug — the impact is identity confusion between unrelated clients sharing a backend connection. It only applies to a specific, narrower combination of conditions: HTTP/3 enabled on the entrypoint, a backend that binds identity to a persistent connection via NTLM or Negotiate, and backend keep-alive/connection reuse. Per the advisory, deployments using ordinary per-request authentication (e.g., typical bearer tokens or session cookies) are not affected. Organizations fronting legacy Windows-integrated-auth backends (NTLM/Kerberos) with Traefik and HTTP/3 enabled are the ones at real risk — any authenticated user's session could potentially be inherited by another client hitting the same route.

What defenders should watch for now

• Inventory Traefik deployments and confirm Traefik version — check whether HTTP/3 is enabled on entrypoints (http3 config) and whether any routed backend relies on connection-bound NTLM or Negotiate authentication.
• If HTTP/3 plus NTLM/Negotiate backends are in use and patching isn't immediate, consider disabling HTTP/3 on affected entrypoints or disabling backend keep-alive as a stopgap, since both are listed prerequisites for exploitation.
• For hunting: look for anomalous patterns where a single backend TCP connection identifier serves distinct client-identity contexts in a short window, or where WWW-Authenticate/NTLM negotiation on a backend connection precedes requests attributable to a different frontend client/session.
• Review access logs on affected routes for state-changing requests lacking expected Authorization headers that nonetheless succeeded — a signature consistent with the described inheritance behavior.

Developing situation

This is fresh, net-new intel from a GitHub Security Advisory published 2026-09-10 with a public PoC; full downstream impact and exploitation-in-the-wild status are not yet established. Patched releases (v2.11.57, v3.7.13) are available — prioritize upgrading affected Traefik instances. For full technical details, see the original advisory: GHSA-qqjf-53cj-pwvv.