CVE-2026-121966 · Runtime
NO FIX YET · SEE WHAT TO DO
Traefik sends ForwardAuth subrequests through one connection pool shared by all clients, so NTLM or Negotiate authenticated connections can be reused across users. An unauthenticated attacker can receive another user's identity headers and reach backends as that user.
first public Oct 21, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Teams running Traefik 2.x before 2.11.60 or 3.x before 3.7.16 with ForwardAuth middleware, and in 3.7 Ingress NGINX auth-url, against an auth server that uses connection-bound NTLM or Negotiate authentication. Deployments using token-based or non-connection-bound auth are not described as affected.
Not affected if default-config, managed-hosting, non-ntlm-auth
Who cares ingress-nginx, kubernetes, self-hosted, traefik
traefik version or the container image tag.forwardAuth middleware or Ingress NGINX auth-url annotations that point to an auth server using NTLM or Negotiate.2.11.60 or later.3.7.16 or later.Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
This page as .md · .json · in your agent: get_signal("CVE-2026-121966") · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.