CVE-2026-71324

CVE-2026-71324 in Traefik is a connection pool poisoning vulnerability that merits more attention than its CVSS 7 suggests. The core issue: when Traefik forwards CONNECT requests to an upstream that returns a non-2xx response without draining the response body, those leftover bytes remain in the socket. When Traefik returns that socket to its shared net/http.Transport pool, the next client request using that socket receives the attacker's buffered content as its legitimate response. This is not a timing-dependent race condition—the socket reinsertion is deterministic once the upstream fails to drain. The ForwardAuth path compounds this significantly. If you use Traefik's ForwardAuth middleware (which maintains a separate connection pool for authentication requests), an attacker who poisons that pool can capture credentials or session tokens intended for your authentication backend. Each subsequent legitimate request through that pool segment automatically receives the attacker's payload. This transforms a single-response disclosure into a persistent credential harvesting mechanism. What makes this more exploitable than the CVSS implies: RFC 7230 does not mandate body draining on non-2xx CONNECT responses, meaning many compliant reverse proxies, API gateways, and legacy systems naturally exhibit the vulnerable behavior without being misconfigured. Your CONNECT forward target does not need to be malicious—it just needs to be RFC-compliant in a way that leaves the body undrained. Check your deployment: if you forward CONNECT to any upstream and use ForwardAuth, you face the full attack surface. Even without ForwardAuth, any multi-tenant or shared-connection environment is vulnerable. The fix involves draining response bodies on non-2xx CONNECT responses before pool reinsertion and ensuring the auth-client pool is isolated from general-purpose pool reuse. Verify your Traefik version includes the relevant fix, and treat any CONNECT-forwarding configuration as a high-priority patching target regardless of the CVSS score—this flaw follows a well-documented lineage of HTTP desync vulnerabilities that consistently receive conservative initial ratings and prove far more severe in practice.

Reviewed through automated stages and approved by a human before publication.