{"id":"CVE-2026-121966","kind":"vulnerability","aliases":["CVE-2026-121966"],"related":[],"title":"Traefik: shared auth connection pool lets attackers reuse victims' sessions","description":"Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.","summary":"Traefik sends ForwardAuth subrequests through one connection pool shared by all clients, so NTLM or Negotiate authenticated connections can be reused across users. An unauthenticated attacker can receive another user's identity headers and reach backends as that user.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ingress-nginx","kubernetes","runtime","self-hosted","traefik"],"not_affected_if":["default-config","managed-hosting","non-ntlm-auth"],"how_to_check":"- Check the Traefik version with `traefik version` or the container image tag.\n- Look for `forwardAuth` middleware or Ingress NGINX `auth-url` annotations that point to an auth server using NTLM or Negotiate.","fix":"- Traefik 2.x: move to `2.11.60` or later.\n- Traefik 3.x: move to `3.7.16` or later.","status":"open","published_at":"2026-11-04T16:17:50+00:00","first_seen_at":"2026-11-04T16:28:15+00:00","triaged_at":"2026-11-04T16:28:41+00:00","updated_at":"2026-11-04T16:28:41+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T16:28:41Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik 2.x: move to `2.11.60` or later.\n- Traefik 3.x: move to `3.7.16` or later.","reach":"internet","title":"Traefik: shared auth connection pool lets attackers reuse victims' sessions","impact":"high","summary":"Traefik sends ForwardAuth subrequests through one connection pool shared by all clients, so NTLM or Negotiate authenticated connections can be reused across users. An unauthenticated attacker can receive another user's identity headers and reach backends as that user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","self-hosted","kubernetes","ingress-nginx"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker reaches backends as another authenticated user","analyst_note":"Confirm from the vendor advisory (github.com) which auth schemes are affected and whether non-NTLM/Negotiate setups are safe.","how_to_check":"- Check the Traefik version with `traefik version` or the container image tag.\n- Look for `forwardAuth` middleware or Ingress NGINX `auth-url` annotations that point to an auth server using NTLM or Negotiate.\n- unknown for anything beyond this in the sources.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","non-ntlm-auth","managed-hosting"],"who_is_affected":"Teams running Traefik 2.x before 2.11.60 or 3.x before 3.7.16 with ForwardAuth middleware, and in 3.7 Ingress NGINX auth-url, against an auth server that uses connection-bound NTLM or Negotiate authentication. Deployments using token-based or non-connection-bound auth are not described as affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4245,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-121966':13A,16A '-2026':12A,15A '2':66C '2.11.60':69C '3':71C '3.7':80C '3.7.16':74C 'access':124C 'across':47B 'anoth':54B,111C 'attack':7A,51B,108C 'auth':3A,84C,90C 'auth-serv':89C 'auth-url':83C 'authent':42B,105C,114C 'authresponsehead':122C 'backend':61B,125C 'bound':101C 'client':37B,97C 'connect':4A,32B,43B,92C,100C,115C 'connection-bound':99C 'cve':11A,14A 'expos':98C 'forwardauth':28B,76C 'header':58B 'host':24B 'ident':57B,120C 'ingress':18B,81C 'ingress-nginx':17B 'kubernet':20B 'let':6A 'negoti':41B,104C 'nginx':19B,82C 'ntlm':39B,102C 'one':31B 'pool':5A,33B,93C 'reach':60B 'receiv':53B,116C 'request':86C 'reus':8A,46B,110C 'runtim':21B 'self':23B 'self-host':22B 'send':27B,75C 'server':91C 'session':10A 'share':2A,34B,94C 'subrequest':29B,77C 'traefik':1A,25B,26B,65C 'unauthent':50B,107C 'url':85C 'user':48B,55B,64B,112C,128C 'via':121C 'victim':9A,118C 'x':67C,72C","nicknames":[],"mitigations":[],"who_affected":"Teams running Traefik 2.x before 2.11.60 or 3.x before 3.7.16 with ForwardAuth middleware, and in 3.7 Ingress NGINX auth-url, against an auth server that uses connection-bound NTLM or Negotiate authentication. Deployments using token-based or non-connection-bound auth are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ingressnginx","kubernetes","runtime","selfhosted","traefik"],"campaign_type":null,"first_public_at":"2026-10-21T09:27:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121966","severity":null,"published_at":"2026-11-04T16:17:50+00:00","modified_at":"2026-11-04T16:17:50+00:00","first_seen_at":"2026-11-04T16:28:15+00:00","fetched_at":"2026-11-04T16:28:15+00:00","note":null}],"documents":[{"id":68505,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T09:27:01+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":68506,"url":"https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}