CVE-2026-88007

A flaw in Traefik's HTTP/3 ConnContext allows unauthenticated remote attackers to bypass authentication on backends using connection-bound NTLM or Negotiate protocols. Missing service.AddTransportOnContext calls lead to shared kerberosRoundTripper transports, enabling attackers to hijack persiste...