GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-hrpp-p4fc-wwf8 · Runtime
FIX → v2.11.60 · v3.7.16
Traefik's ForwardAuth middleware shares one connection pool for auth subrequests, so a connection-bound login (NTLM or Negotiate) from one user can be reused for another client's request. An unauthenticated client can receive the victim's identity and reach the backend as that user.
first public Oct 21, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Exposed when Traefik ForwardAuth or the Kubernetes auth-url annotation calls an authentication server that uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, for example IIS Windows Authentication. Deployments that use only token or cookie based auth servers are not affected by this connection reuse path.
Not affected if managed-hosting, no-forwardauth, token-auth-only
Who cares forwardauth, iis, ingress-nginx, kubernetes, traefik, windows-authentication
traefik version and compare it with the affected ranges.forwardAuth middleware or the Kubernetes auth-url annotation in the Traefik configuration.There is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate" (for example IIS Windows Authentication). ForwardAuth sends its authentication subrequests through a connection pool shared by every client of the middleware, so an auth-server connection already authenticated by one user can be reused for the subrequest of an unrelated client. An unauthenticated client on a separate frontend connection can then receive a successful authentication response carrying the victim's identity, which Traefik forwards to the backend through authResponseHeaders, and access the backend as that user. In Traefik v3.7 the same applies to the external authentication requests issued for the Kubernetes Ingress NGINX provider's auth-url annotation.
This is a distinct issue from GHSA-53qr-784g-cj35, GHSA-qqjf-53cj-pwvv, GHSA-cw35-4q88-3rmp and GHSA-qm9f-w54v-q2qh, which isolated connection-bound authentication on the backend proxy paths only; the fix applies the same per-frontend-connection isolation to the authentication server. Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line, and users on those versions must upgrade to v2.11.60 or v3.7.16.
If you have any questions or comments about this advisory, please open an issue.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to v2.11.60 · v3.7.16
v2.11.60.v3.7.16.v2.11.60 or v3.7.16.