---
id: "CVE-2026-121966"
kind: "vulnerability"
aliases: ["CVE-2026-121966"]
title: "Traefik: shared auth connection pool lets attackers reuse victims' sessions"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ingress-nginx", "kubernetes", "runtime", "self-hosted", "traefik"]
not_affected_if: ["default-config", "managed-hosting", "non-ntlm-auth"]
published_at: "2026-11-04T16:17:50+00:00"
first_seen_at: "2026-11-04T16:28:15+00:00"
updated_at: "2026-11-04T16:28:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121966", "first_seen_at": "2026-11-04T16:28:15+00:00"}]
---

# Traefik: shared auth connection pool lets attackers reuse victims' sessions

Traefik sends ForwardAuth subrequests through one connection pool shared by all clients, so NTLM or Negotiate authenticated connections can be reused across users. An unauthenticated attacker can receive another user's identity headers and reach backends as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Traefik version with `traefik version` or the container image tag.
- Look for `forwardAuth` middleware or Ingress NGINX `auth-url` annotations that point to an auth server using NTLM or Negotiate.

## Fix

- Traefik 2.x: move to `2.11.60` or later.
- Traefik 3.x: move to `3.7.16` or later.

## Timeline

- 2026-11-04T16:28:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121966

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak

## From the sources

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_