{"id":"GHSA-hrpp-p4fc-wwf8","kind":"vulnerability","aliases":["GHSA-hrpp-p4fc-wwf8"],"related":[],"title":"ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients","description":"## Summary\n\nThere is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos \"Negotiate\" (for example IIS Windows Authentication). ForwardAuth sends its authentication subrequests through a connection pool shared by every client of the middleware, so an auth-server connection already authenticated by one user can be reused for the subrequest of an unrelated client. An unauthenticated client on a separate frontend connection can then receive a successful authentication response carrying the victim's identity, which Traefik forwards to the backend through `authResponseHeaders`, and access the backend as that user. In Traefik v3.7 the same applies to the external authentication requests issued for the Kubernetes Ingress NGINX provider's `auth-url` annotation.\n\nThis is a distinct issue from GHSA-53qr-784g-cj35, GHSA-qqjf-53cj-pwvv, GHSA-cw35-4q88-3rmp and GHSA-qm9f-w54v-q2qh, which isolated connection-bound authentication on the backend proxy paths only; the fix applies the same per-frontend-connection isolation to the authentication server. Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line, and users on those versions must upgrade to v2.11.60 or v3.7.16.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.60\n- https://github.com/traefik/traefik/releases/tag/v3.7.16\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's ForwardAuth middleware shares one connection pool for auth subrequests, so a connection-bound login (NTLM or Negotiate) from one user can be reused for another client's request. An unauthenticated client can receive the victim's identity and reach the backend as that user.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.60"],"affected":"<= v2.11.59","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.16"],"affected":">= v3.0.0, <= v3.7.15","ecosystem":"go"}],"ecosystems":["go"],"tags":["forwardauth","iis","ingress-nginx","kubernetes","runtime","traefik","windows-authentication"],"not_affected_if":["managed-hosting","no-forwardauth","token-auth-only"],"how_to_check":"- Check the Traefik version with `traefik version` and compare it with the affected ranges.\n- Look for `forwardAuth` middleware or the Kubernetes `auth-url` annotation in the Traefik configuration.\n- Confirm whether the auth server is IIS Windows Authentication or another NTLM/Negotiate service.","fix":"- Traefik v2: move to `v2.11.60`.\n- Traefik v3: move to `v3.7.16`.\n- Traefik v3.0 through v3.6 are end-of-life and receive no fix on their line; upgrade to `v2.11.60` or `v3.7.16`.","status":"open","published_at":"2026-10-21T09:27:01+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","triaged_at":"2026-11-09T22:54:29+00:00","updated_at":"2026-11-09T22:54:29+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-09T22:54:29Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: move to `v2.11.60`.\n- Traefik v3: move to `v3.7.16`.\n- Traefik v3.0 through v3.6 are end-of-life and receive no fix on their line; upgrade to `v2.11.60` or `v3.7.16`.","reach":"internet","title":"Traefik: ForwardAuth can reuse NTLM identities across unrelated clients","impact":"high","summary":"Traefik's ForwardAuth middleware shares one connection pool for auth subrequests, so a connection-bound login (NTLM or Negotiate) from one user can be reused for another client's request. An unauthenticated client can receive the victim's identity and reach the backend as that user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["traefik","forwardauth","iis","windows-authentication","kubernetes","ingress-nginx"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated client gains a victim's identity and backend access","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` and compare it with the affected ranges.\n- Look for `forwardAuth` middleware or the Kubernetes `auth-url` annotation in the Traefik configuration.\n- Confirm whether the auth server is IIS Windows Authentication or another NTLM/Negotiate service.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["token-auth-only","no-forwardauth","managed-hosting"],"who_is_affected":"Exposed when Traefik ForwardAuth or the Kubernetes auth-url annotation calls an authentication server that uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, for example IIS Windows Authentication. Deployments that use only token or cookie based auth servers are not affected by this connection reuse path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000867,"input_tokens":5175,"output_tokens":699,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'/traefik/traefik/issues).':330C '/traefik/traefik/releases/tag/v2.11.60':307C '/traefik/traefik/releases/tag/v3.7.16':310C '/traefik/traefik/v2':26A '/traefik/traefik/v3':29A '3rmp':237C '4q88':236C '53cj':231C '53qr':225C '784g':226C 'access':188C 'across':12A 'advisori':323C 'affect':282C 'alreadi':144C 'also':281C 'annot':216C 'anoth':68B 'appli':199C,258C 'auth':5A,50B,141C,214C 'auth-serv':4A,140C 'auth-url':213C 'authent':40B,94C,103C,121C,125C,145C,172C,203C,249C,268C 'authresponsehead':186C 'backend':84B,184C,190C,252C 'bound':56B,109C,248C 'carri':174C 'cj35':227C 'client':13A,69B,74B,134C,158C,161C 'comment':320C 'connect':7A,47B,55B,108C,129C,143C,166C,247C,264C 'connection-bound':54B,107C,246C 'cw35':235C 'distinct':220C 'end':276C 'end-of-lif':275C 'everi':133C 'exampl':118C 'extern':202C 'fix':257C,288C 'forward':181C 'forwardauth':1A,30B,43B,99C,122C 'frontend':165C,263C 'ghsa':15A,20A,224C,229C,234C,240C 'ghsa-53qr-784g-cj35':223C 'ghsa-cw35-4q88-3rmp':233C 'ghsa-hrpp-p4fc-wwf8':14A,19A 'ghsa-qm9f-w54v-q2qh':239C 'ghsa-qqjf-53cj-pwvv':228C 'github.com':25A,28A,306C,309C,329C 'github.com/traefik/traefik/issues).':328C 'github.com/traefik/traefik/releases/tag/v2.11.60':305C 'github.com/traefik/traefik/releases/tag/v3.7.16':308C 'github.com/traefik/traefik/v2':24A 'github.com/traefik/traefik/v3':27A 'high':92C 'hrpp':16A,21A 'ident':11A,80B,178C 'ii':31B,119C 'inform':313C 'ingress':33B,209C 'ingress-nginx':32B 'isol':245C,265C 'issu':205C,221C,327C 'kubernet':35B,208C 'leak':9A 'life':278C 'line':292C 'login':57B 'middlewar':44B,100C,137C 'must':298C 'negoti':60B,116C 'nginx':34B,210C 'ntlm':58B,113C 'ntlm/negotiate-bound':10A 'one':46B,62B,147C 'open':325C 'p4fc':17A,22A 'patch':304C 'path':254C 'per':262C 'per-frontend-connect':261C 'pleas':324C 'pool':8A,48B,130C 'provid':211C 'proxi':253C 'pwvv':232C 'q2qh':243C 'qm9f':241C 'qqjf':230C 'question':318C 'reach':82B 'receiv':76B,169C,286C 'request':71B,204C 'respons':173C 'reus':66B,151C 'runtim':36B 'scheme':110C 'send':123C 'separ':164C 'server':6A,104C,142C,269C 'sever':93C 'share':2A,45B,131C 'spnego/kerberos':115C 'subrequest':51B,126C,154C 'success':171C 'summari':88C 'traefik':37B,41B,97C,180C,195C,270C 'unauthent':73B,160C 'unrel':157C 'upgrad':299C 'url':215C 'use':105C 'user':63B,87B,148C,193C,294C 'v2.11.60':301C 'v3.0':271C 'v3.6':273C 'v3.7':196C 'v3.7.16':303C 'version':297C 'victim':78B,176C 'vulner':95C 'w54v':242C 'window':39B,120C 'windows-authent':38B 'wwf8':18A,23A","nicknames":[],"mitigations":[],"who_affected":"Exposed when Traefik ForwardAuth or the Kubernetes auth-url annotation calls an authentication server that uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, for example IIS Windows Authentication. Deployments that use only token or cookie based auth servers are not affected by this connection reuse path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["forwardauth","go","high","iis","ingressnginx","kubernetes","runtime","traefik","windowsauthentication"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':26A '/traefik/traefik/v3':29A 'across':12A 'auth':5A 'auth-serv':4A 'client':13A 'connect':7A 'forwardauth':1A 'ghsa':15A,20A 'ghsa-hrpp-p4fc-wwf8':14A,19A 'github.com':25A,28A 'github.com/traefik/traefik/v2':24A 'github.com/traefik/traefik/v3':27A 'hrpp':16A,21A 'ident':11A 'leak':9A 'ntlm/negotiate-bound':10A 'p4fc':17A,22A 'pool':8A 'server':6A 'share':2A 'wwf8':18A,23A","search_b":"'anoth':68B 'auth':50B 'authent':40B 'backend':84B 'bound':56B 'client':69B,74B 'connect':47B,55B 'connection-bound':54B 'forwardauth':30B,43B 'ident':80B 'ii':31B 'ingress':33B 'ingress-nginx':32B 'kubernet':35B 'login':57B 'middlewar':44B 'negoti':60B 'nginx':34B 'ntlm':58B 'one':46B,62B 'pool':48B 'reach':82B 'receiv':76B 'request':71B 'reus':66B 'runtim':36B 'share':45B 'subrequest':51B 'traefik':37B,41B 'unauthent':73B 'user':63B,87B 'victim':78B 'window':39B 'windows-authent':38B","search_c":"'/traefik/traefik/issues).':330C '/traefik/traefik/releases/tag/v2.11.60':307C '/traefik/traefik/releases/tag/v3.7.16':310C '3rmp':237C '4q88':236C '53cj':231C '53qr':225C '784g':226C 'access':188C 'advisori':323C 'affect':282C 'alreadi':144C 'also':281C 'annot':216C 'appli':199C,258C 'auth':141C,214C 'auth-serv':140C 'auth-url':213C 'authent':94C,103C,121C,125C,145C,172C,203C,249C,268C 'authresponsehead':186C 'backend':184C,190C,252C 'bound':109C,248C 'carri':174C 'cj35':227C 'client':134C,158C,161C 'comment':320C 'connect':108C,129C,143C,166C,247C,264C 'connection-bound':107C,246C 'cw35':235C 'distinct':220C 'end':276C 'end-of-lif':275C 'everi':133C 'exampl':118C 'extern':202C 'fix':257C,288C 'forward':181C 'forwardauth':99C,122C 'frontend':165C,263C 'ghsa':224C,229C,234C,240C 'ghsa-53qr-784g-cj35':223C 'ghsa-cw35-4q88-3rmp':233C 'ghsa-qm9f-w54v-q2qh':239C 'ghsa-qqjf-53cj-pwvv':228C 'github.com':306C,309C,329C 'github.com/traefik/traefik/issues).':328C 'github.com/traefik/traefik/releases/tag/v2.11.60':305C 'github.com/traefik/traefik/releases/tag/v3.7.16':308C 'high':92C 'ident':178C 'ii':119C 'inform':313C 'ingress':209C 'isol':245C,265C 'issu':205C,221C,327C 'kubernet':208C 'life':278C 'line':292C 'middlewar':100C,137C 'must':298C 'negoti':116C 'nginx':210C 'ntlm':113C 'one':147C 'open':325C 'patch':304C 'path':254C 'per':262C 'per-frontend-connect':261C 'pleas':324C 'pool':130C 'provid':211C 'proxi':253C 'pwvv':232C 'q2qh':243C 'qm9f':241C 'qqjf':230C 'question':318C 'receiv':169C,286C 'request':204C 'respons':173C 'reus':151C 'scheme':110C 'send':123C 'separ':164C 'server':104C,142C,269C 'sever':93C 'share':131C 'spnego/kerberos':115C 'subrequest':126C,154C 'success':171C 'summari':88C 'traefik':97C,180C,195C,270C 'unauthent':160C 'unrel':157C 'upgrad':299C 'url':215C 'use':105C 'user':148C,193C,294C 'v2.11.60':301C 'v3.0':271C 'v3.6':273C 'v3.7':196C 'v3.7.16':303C 'version':297C 'victim':176C 'vulner':95C 'w54v':242C 'window':120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-21T09:27:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-hrpp-p4fc-wwf8","url":"https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8","severity":"high","published_at":"2026-10-21T09:27:01+00:00","modified_at":"2026-10-21T09:27:01+00:00","first_seen_at":"2026-11-09T22:53:32+00:00","fetched_at":"2026-11-09T22:53:32+00:00","note":null}],"documents":[{"id":68505,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-21T09:27:01+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}