GITHUB.COM/TRAEFIK/TRAEFIK/V2 · GHSA-p956-6gvv-mxqp · Infrastructure
FIX → v2.11.62 · v3.8.0-rc.2 +1
Traefik's ForwardAuth middleware shares authentication-server connections for Proxy-Authorization credentials, so an unauthenticated client can reuse a connection already authenticated as another user. The attacker then receives that user's identity headers and reaches the backend as them.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Exposure requires a ForwardAuth middleware whose authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, and a client that can send a Proxy-Authorization header. Deployments using token-based or other stateless ForwardAuth backends, or that restrict forwarded headers to exclude Proxy-Authorization, are not affected. Traefik v3.0 through v3.6 are end-of-life and will not get a fix on their own line.
Not affected if authrequestheaders-excludes-proxy-authorization, no-forwardauth, token-auth-only
Who cares forwardauth, kerberos, ntlm, self-hosted, traefik
traefik version or the image tag, and compare against the affected ranges.forwardAuth middleware with NTLM or SPNEGO/Kerberos Negotiate authentication servers in the Traefik configuration.There is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate". The fix for GHSA-hrpp-p4fc-wwf8 sends the subrequests of a client that presents such a credential on a dedicated connection to the authentication server, but it only detects the credential in the Authorization header. ForwardAuth also forwards the Proxy-Authorization header, and a credential sent in that header still goes through the connection pool shared by every client. An unauthenticated client can then reuse an authentication-server connection already authenticated by another user, receive that user's identity through authResponseHeaders, and access the backend as that user. The patched versions apply the same isolation to Proxy-Authorization.
Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line. As a workaround, set authRequestHeaders to a list that does not include Proxy-Authorization.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
authRequestHeadersProxy-AuthorizationUpgrade to v2.11.62 · v3.8.0-rc.2 +1
v2.11.62.v3.7.18.v3.8.0-rc.2.authRequestHeaders to a list that does not include Proxy-Authorization.If you have any questions or comments about this advisory, please open an issue.