---
id: "GHSA-hrpp-p4fc-wwf8"
page: "https://infrastack.ai/live/GHSA-hrpp-p4fc-wwf8"
kind: "vulnerability"
aliases: ["GHSA-hrpp-p4fc-wwf8"]
title: "ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.60"], "affected": "<= v2.11.59", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.16"], "affected": ">= v3.0.0, <= v3.7.15", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["forwardauth", "iis", "ingress-nginx", "kubernetes", "runtime", "traefik", "windows-authentication"]
not_affected_if: ["managed-hosting", "no-forwardauth", "token-auth-only"]
published_at: "2026-10-21T09:27:01+00:00"
first_seen_at: "2026-11-09T22:53:32+00:00"
updated_at: "2026-11-09T22:54:29+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8", "first_seen_at": "2026-11-09T22:53:32+00:00"}]
exploit_sources: []
---

# ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients

Link for people: https://infrastack.ai/live/GHSA-hrpp-p4fc-wwf8 (this .md is for agents)

Traefik's ForwardAuth middleware shares one connection pool for auth subrequests, so a connection-bound login (NTLM or Negotiate) from one user can be reused for another client's request. An unauthenticated client can receive the victim's identity and reach the backend as that user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.59 fixed v2.11.60
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.15 fixed v3.7.16

## How to check

- Check the Traefik version with `traefik version` and compare it with the affected ranges.
- Look for `forwardAuth` middleware or the Kubernetes `auth-url` annotation in the Traefik configuration.
- Confirm whether the auth server is IIS Windows Authentication or another NTLM/Negotiate service.

## Fix

- Traefik v2: move to `v2.11.60`.
- Traefik v3: move to `v3.7.16`.
- Traefik v3.0 through v3.6 are end-of-life and receive no fix on their line; upgrade to `v2.11.60` or `v3.7.16`.

## Timeline

- 2026-11-09T22:53:32+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8

## Documents

- [advisory] Vendor advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8

## From the sources

## Summary

There is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate" (for example IIS Windows Authentication). ForwardAuth sends its authentication subrequests through a connection pool shared by every client of the middleware, so an auth-server connection already authenticated by one user can be reused for the subrequest of an unrelated client. An unauthenticated client on a separate frontend connection can then receive a successful authentication response carrying the victim's identity, which Traefik forwards to the backend through `authResponseHeaders`, and access the backend as that user. In Traefik v3.7 the same applies to the external authentication requests issued for the Kubernetes Ingress NGINX provider's `auth-url` annotation.

This is a distinct issue from GHSA-53qr-784g-cj35, GHSA-qqjf-53cj-pwvv, GHSA-cw35-4q88-3rmp and GHSA-qm9f-w54v-q2qh, which isolated connection-bound authentication on the backend proxy paths only; the fix applies the same per-frontend-connection isolation to the authentication server. Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line, and users on those versions must upgrade to v2.11.60 or v3.7.16.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.60
- https://github.com/traefik/traefik/releases/tag/v3.7.16

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_