{"id":"GHSA-p956-6gvv-mxqp","kind":"vulnerability","aliases":["GHSA-p956-6gvv-mxqp"],"related":[],"title":"Incomplete fix for GHSA-hrpp-p4fc-wwf8 allows ForwardAuth NTLM authentication bypass via Proxy-Authorization","description":"## Summary\n\nThere is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos \"Negotiate\". The fix for GHSA-hrpp-p4fc-wwf8 sends the subrequests of a client that presents such a credential on a dedicated connection to the authentication server, but it only detects the credential in the `Authorization` header. ForwardAuth also forwards the `Proxy-Authorization` header, and a credential sent in that header still goes through the connection pool shared by every client. An unauthenticated client can then reuse an authentication-server connection already authenticated by another user, receive that user's identity through `authResponseHeaders`, and access the backend as that user. The patched versions apply the same isolation to `Proxy-Authorization`.\n\nTraefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line. As a workaround, set `authRequestHeaders` to a list that does not include `Proxy-Authorization`.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.62\n- https://github.com/traefik/traefik/releases/tag/v3.7.18\n- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).","summary":"Traefik's ForwardAuth middleware shares authentication-server connections for Proxy-Authorization credentials, so an unauthenticated client can reuse a connection already authenticated as another user. The attacker then receives that user's identity headers and reaches the backend as them.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/traefik/traefik/v2","fixed":["v2.11.62"],"affected":"<= v2.11.61","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.7.18"],"affected":">= v3.0.0, <= v3.7.17","ecosystem":"go"},{"name":"github.com/traefik/traefik/v3","fixed":["v3.8.0-rc.2"],"affected":">= v3.8.0-rc.1, <= v3.8.0-rc.1","ecosystem":"go"}],"ecosystems":["go"],"tags":["cwe-287","cwe-863","forwardauth","infrastructure","kerberos","ntlm","self-hosted","traefik"],"not_affected_if":["authrequestheaders-excludes-proxy-authorization","no-forwardauth","token-auth-only"],"how_to_check":"- Check the Traefik version with `traefik version` or the image tag, and compare against the affected ranges.\n- Look for `forwardAuth` middleware with NTLM or SPNEGO/Kerberos Negotiate authentication servers in the Traefik configuration.\n- Check whether `authRequestHeaders` is set and whether it includes `Proxy-Authorization`.","fix":"- Traefik v2: move to `v2.11.62`.\n- Traefik v3: move to `v3.7.18`.\n- Traefik v3.8 release candidate: move to `v3.8.0-rc.2`.\n- Workaround from the advisory: set `authRequestHeaders` to a list that does not include `Proxy-Authorization`.","status":"open","published_at":"2026-11-12T10:01:24+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","triaged_at":"2026-11-12T10:10:17+00:00","updated_at":"2026-11-12T10:10:17+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-12T10:10:17Z","model":"claude-haiku-5-5","output":{"fix":"- Traefik v2: move to `v2.11.62`.\n- Traefik v3: move to `v3.7.18`.\n- Traefik v3.8 release candidate: move to `v3.8.0-rc.2`.\n- Workaround from the advisory: set `authRequestHeaders` to a list that does not include `Proxy-Authorization`.","reach":"internet","title":"Traefik: ForwardAuth NTLM bypass via Proxy-Authorization header lets users impersonate others","impact":"high","summary":"Traefik's ForwardAuth middleware shares authentication-server connections for Proxy-Authorization credentials, so an unauthenticated client can reuse a connection already authenticated as another user. The attacker then receives that user's identity headers and reaches the backend as them.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["traefik","forwardauth","ntlm","kerberos","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated client gains another user's identity and backend access","analyst_note":"","how_to_check":"- Check the Traefik version with `traefik version` or the image tag, and compare against the affected ranges.\n- Look for `forwardAuth` middleware with NTLM or SPNEGO/Kerberos Negotiate authentication servers in the Traefik configuration.\n- Check whether `authRequestHeaders` is set and whether it includes `Proxy-Authorization`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["token-auth-only","authRequestHeaders-excludes-proxy-authorization","no-forwardauth"],"who_is_affected":"Exposure requires a ForwardAuth middleware whose authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, and a client that can send a Proxy-Authorization header. Deployments using token-based or other stateless ForwardAuth backends, or that restrict forwarded headers to exclude Proxy-Authorization, are not affected. Traefik v3.0 through v3.6 are end-of-life and will not get a fix on their own line.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000915,"input_tokens":5173,"output_tokens":795,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-287':38B '-863':40B '/traefik/traefik/issues).':288C '/traefik/traefik/releases/tag/v2.11.62':262C '/traefik/traefik/releases/tag/v3.7.18':265C '/traefik/traefik/releases/tag/v3.8.0-rc.2':268C '/traefik/traefik/v2':30A '/traefik/traefik/v3':33A,36A '6gvv':21A,26A 'access':204C 'advisori':281C 'affect':233C 'allow':9A 'alreadi':71B,191C 'also':156C,232C 'anoth':74B,194C 'appli':213C 'attack':77B 'authent':12A,55B,72B,95C,104C,143C,188C,192C 'authentication-serv':54B,187C 'author':17A,61B,153C,161C,220C,258C 'authrequesthead':248C 'authresponsehead':202C 'backend':88B,206C 'bound':110C 'bypass':13A 'client':66B,131C,179C,182C 'comment':278C 'connect':57B,70B,109C,140C,174C,190C 'connection-bound':108C 'credenti':62B,136C,150C,165C 'cwe':37B,39B 'dedic':139C 'detect':148C 'end':227C 'end-of-lif':226C 'everi':178C 'fix':2A,119C,239C 'forward':157C 'forwardauth':10A,41B,51B,100C,155C 'ghsa':5A,19A,24A,122C 'ghsa-hrpp-p4fc-wwf8':4A,121C 'ghsa-p956-6gvv-mxqp':18A,23A 'github.com':29A,32A,35A,261C,264C,267C,287C 'github.com/traefik/traefik/issues).':286C 'github.com/traefik/traefik/releases/tag/v2.11.62':260C 'github.com/traefik/traefik/releases/tag/v3.7.18':263C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':266C 'github.com/traefik/traefik/v2':28A 'github.com/traefik/traefik/v3':31A,34A 'goe':171C 'header':84B,154C,162C,169C 'high':93C 'host':47B 'hrpp':6A,123C 'ident':83B,200C 'includ':255C 'incomplet':1A 'inform':271C 'infrastructur':42B 'isol':216C 'issu':285C 'kerbero':43B 'life':229C 'line':243C 'list':251C 'middlewar':52B,101C 'mxqp':22A,27A 'negoti':117C 'ntlm':11A,44B,114C 'open':283C 'p4fc':7A,124C 'p956':20A,25A 'patch':211C,259C 'pleas':282C 'pool':175C 'present':133C 'proxi':16A,60B,160C,219C,257C 'proxy-author':15A,59B,159C,218C,256C 'question':276C 'reach':86B 'receiv':79B,196C,237C 'reus':68B,185C 'scheme':111C 'self':46B 'self-host':45B 'send':126C 'sent':166C 'server':56B,105C,144C,189C 'set':247C 'sever':94C 'share':53B,176C 'spnego/kerberos':116C 'still':170C 'subrequest':128C 'summari':89C 'traefik':48B,49B,98C,221C 'unauthent':65B,181C 'use':106C 'user':75B,81B,195C,198C,209C 'v3.0':222C 'v3.6':224C 'version':212C 'via':14A 'vulner':96C 'workaround':246C 'wwf8':8A,125C","nicknames":[],"mitigations":[],"who_affected":"Exposure requires a ForwardAuth middleware whose authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos Negotiate, and a client that can send a Proxy-Authorization header. Deployments using token-based or other stateless ForwardAuth backends, or that restrict forwarded headers to exclude Proxy-Authorization, are not affected. Traefik v3.0 through v3.6 are end-of-life and will not get a fix on their own line.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["githubcomtraefiktraefikv2","githubcomtraefiktraefikv3"],"ptokens":["com","github","traefik","v2","v3"],"labels":["cwe287","cwe863","forwardauth","go","high","infrastructure","kerberos","ntlm","selfhosted","traefik"],"campaign_type":null,"search_a":"'/traefik/traefik/v2':30A '/traefik/traefik/v3':33A,36A '6gvv':21A,26A 'allow':9A 'authent':12A 'author':17A 'bypass':13A 'fix':2A 'forwardauth':10A 'ghsa':5A,19A,24A 'ghsa-hrpp-p4fc-wwf8':4A 'ghsa-p956-6gvv-mxqp':18A,23A 'github.com':29A,32A,35A 'github.com/traefik/traefik/v2':28A 'github.com/traefik/traefik/v3':31A,34A 'hrpp':6A 'incomplet':1A 'mxqp':22A,27A 'ntlm':11A 'p4fc':7A 'p956':20A,25A 'proxi':16A 'proxy-author':15A 'via':14A 'wwf8':8A","search_b":"'-287':38B '-863':40B 'alreadi':71B 'anoth':74B 'attack':77B 'authent':55B,72B 'authentication-serv':54B 'author':61B 'backend':88B 'client':66B 'connect':57B,70B 'credenti':62B 'cwe':37B,39B 'forwardauth':41B,51B 'header':84B 'host':47B 'ident':83B 'infrastructur':42B 'kerbero':43B 'middlewar':52B 'ntlm':44B 'proxi':60B 'proxy-author':59B 'reach':86B 'receiv':79B 'reus':68B 'self':46B 'self-host':45B 'server':56B 'share':53B 'traefik':48B,49B 'unauthent':65B 'user':75B,81B","search_c":"'/traefik/traefik/issues).':288C '/traefik/traefik/releases/tag/v2.11.62':262C '/traefik/traefik/releases/tag/v3.7.18':265C '/traefik/traefik/releases/tag/v3.8.0-rc.2':268C 'access':204C 'advisori':281C 'affect':233C 'alreadi':191C 'also':156C,232C 'anoth':194C 'appli':213C 'authent':95C,104C,143C,188C,192C 'authentication-serv':187C 'author':153C,161C,220C,258C 'authrequesthead':248C 'authresponsehead':202C 'backend':206C 'bound':110C 'client':131C,179C,182C 'comment':278C 'connect':109C,140C,174C,190C 'connection-bound':108C 'credenti':136C,150C,165C 'dedic':139C 'detect':148C 'end':227C 'end-of-lif':226C 'everi':178C 'fix':119C,239C 'forward':157C 'forwardauth':100C,155C 'ghsa':122C 'ghsa-hrpp-p4fc-wwf8':121C 'github.com':261C,264C,267C,287C 'github.com/traefik/traefik/issues).':286C 'github.com/traefik/traefik/releases/tag/v2.11.62':260C 'github.com/traefik/traefik/releases/tag/v3.7.18':263C 'github.com/traefik/traefik/releases/tag/v3.8.0-rc.2':266C 'goe':171C 'header':154C,162C,169C 'high':93C 'hrpp':123C 'ident':200C 'includ':255C 'inform':271C 'isol':216C 'issu':285C 'life':229C 'line':243C 'list':251C 'middlewar':101C 'negoti':117C 'ntlm':114C 'open':283C 'p4fc':124C 'patch':211C,259C 'pleas':282C 'pool':175C 'present':133C 'proxi':160C,219C,257C 'proxy-author':159C,218C,256C 'question':276C 'receiv':196C,237C 'reus':185C 'scheme':111C 'send':126C 'sent':166C 'server':105C,144C,189C 'set':247C 'sever':94C 'share':176C 'spnego/kerberos':116C 'still':170C 'subrequest':128C 'summari':89C 'traefik':98C,221C 'unauthent':181C 'use':106C 'user':195C,198C,209C 'v3.0':222C 'v3.6':224C 'version':212C 'vulner':96C 'workaround':246C 'wwf8':125C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T10:01:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-p956-6gvv-mxqp","url":"https://github.com/traefik/traefik/security/advisories/GHSA-p956-6gvv-mxqp","severity":"high","published_at":"2026-11-12T10:01:24+00:00","modified_at":"2026-11-12T10:01:24+00:00","first_seen_at":"2026-11-12T10:09:07+00:00","fetched_at":"2026-11-12T10:09:07+00:00","note":null}],"documents":[{"id":133899,"url":"https://github.com/traefik/traefik/security/advisories/GHSA-p956-6gvv-mxqp","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}