Critical NTLM Connection Reuse Vulnerability in Traefik HTTP/3

According to the GitHub Security Advisory database, Traefik versions prior to v2.11.57 and v3.7.13 are affected by a critical vulnerability involving NTLM and Negotiate authentication over HTTP/3. The issue arises because Traefik's HTTP/3 request path does not initialize the connection-scoped backend transport holder, which isolates connection-bound authentication for HTTP/1.1 and HTTP/2. This oversight allows an unrelated HTTP/3 client to reuse a backend connection authenticated as another user, potentially inheriting the victim's identity and accessing sensitive data or performing actions as the victim without their credentials. Deployments are only affected if HTTP/3 is enabled, the backend uses connection-bound NTLM or Negotiate authentication, and backend keep-alive is active.

Operators should carefully evaluate whether their deployment meets these conditions before upgrading. If HTTP/3 is enabled and the backend relies on connection-bound authentication, immediate patching to v2.11.57 or v3.7.13 is essential to prevent unauthorized access. Additionally, operators should verify whether backend keep-alive settings are in use, as disabling keep-alive could mitigate the risk in the short term. This vulnerability highlights the importance of scrutinizing transport-layer authentication mechanisms when adopting new protocols like HTTP/3.