Read the docs
TI-2026-85105 Aliases CVE-2026-121966GHSA-6cm8-r9cr-2hc7

Traefik ForwardAuth leaks NTLM or Negotiate user identities

Priority LOW 33CWE-488Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 send ForwardAuth subrequests through an auth-server connection pool shared by all clients, which exposes connection-bound NTLM or Negotiate authentication (CWE-488). An unauthenticated attacker can reuse another user's authenticated connection and receive that user's identity through authResponseHeaders to access backends as the victim.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00333 26th percentileScored 2026-11-07
Fix Fixed traefik (traefik): 2.11.60, 3.7.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
traefiktraefikbefore 2.11.602.11.60Patch availableCNA
traefiktraefik3.0.0 to before 3.7.163.7.16Patch availableCNA
  • traefik Vendortraefik Affected before 2.11.60 Fixed in 2.11.60 Patch available CNA
  • traefik Vendortraefik Affected 3.0.0 to before 3.7.16 Fixed in 3.7.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*——traefik
  • cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:* Versions — — ·traefik

Remediation

Upgrade Traefik 2.x to 2.11.60 and Traefik 3.x to 3.7.16.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA traefik (traefik) Fixed in 2.11.60
  • Fix · CNA traefik (traefik) Fixed in 3.7.16

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-121966
  2. 2026-11-04 CISA SSVC decision points changed
  3. 2026-11-04 Priority changed: MEDIUM → LOW
  4. 2026-11-04 Alias added: GHSA-6cm8-r9cr-2hc7
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Advisory 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
  • TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
  • TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
  • TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
  • TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences