---
id: "GHSA-p956-6gvv-mxqp"
page: "https://infrastack.ai/live/GHSA-p956-6gvv-mxqp"
kind: "vulnerability"
aliases: ["GHSA-p956-6gvv-mxqp"]
title: "Incomplete fix for GHSA-hrpp-p4fc-wwf8 allows ForwardAuth NTLM authentication bypass via Proxy-Authorization"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "github.com/traefik/traefik/v2", "fixed": ["v2.11.62"], "affected": "<= v2.11.61", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.7.18"], "affected": ">= v3.0.0, <= v3.7.17", "ecosystem": "go"}, {"name": "github.com/traefik/traefik/v3", "fixed": ["v3.8.0-rc.2"], "affected": ">= v3.8.0-rc.1, <= v3.8.0-rc.1", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-287", "cwe-863", "forwardauth", "infrastructure", "kerberos", "ntlm", "self-hosted", "traefik"]
not_affected_if: ["authrequestheaders-excludes-proxy-authorization", "no-forwardauth", "token-auth-only"]
published_at: "2026-11-12T10:01:24+00:00"
first_seen_at: "2026-11-12T10:09:07+00:00"
updated_at: "2026-11-12T10:10:17+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-p956-6gvv-mxqp", "first_seen_at": "2026-11-12T10:09:07+00:00"}]
exploit_sources: []
---

# Incomplete fix for GHSA-hrpp-p4fc-wwf8 allows ForwardAuth NTLM authentication bypass via Proxy-Authorization

Link for people: https://infrastack.ai/live/GHSA-p956-6gvv-mxqp (this .md is for agents)

Traefik's ForwardAuth middleware shares authentication-server connections for Proxy-Authorization credentials, so an unauthenticated client can reuse a connection already authenticated as another user. The attacker then receives that user's identity headers and reaches the backend as them.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/traefik/traefik/v2 affected <= v2.11.61 fixed v2.11.62
- go:github.com/traefik/traefik/v3 affected >= v3.0.0, <= v3.7.17 fixed v3.7.18
- go:github.com/traefik/traefik/v3 affected >= v3.8.0-rc.1, <= v3.8.0-rc.1 fixed v3.8.0-rc.2

## How to check

- Check the Traefik version with `traefik version` or the image tag, and compare against the affected ranges.
- Look for `forwardAuth` middleware with NTLM or SPNEGO/Kerberos Negotiate authentication servers in the Traefik configuration.
- Check whether `authRequestHeaders` is set and whether it includes `Proxy-Authorization`.

## Fix

- Traefik v2: move to `v2.11.62`.
- Traefik v3: move to `v3.7.18`.
- Traefik v3.8 release candidate: move to `v3.8.0-rc.2`.
- Workaround from the advisory: set `authRequestHeaders` to a list that does not include `Proxy-Authorization`.

## Timeline

- 2026-11-12T10:09:07+00:00 ghsa-repo https://github.com/traefik/traefik/security/advisories/GHSA-p956-6gvv-mxqp

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/traefik/traefik/security/advisories/GHSA-p956-6gvv-mxqp

## From the sources

## Summary

There is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate". The fix for GHSA-hrpp-p4fc-wwf8 sends the subrequests of a client that presents such a credential on a dedicated connection to the authentication server, but it only detects the credential in the `Authorization` header. ForwardAuth also forwards the `Proxy-Authorization` header, and a credential sent in that header still goes through the connection pool shared by every client. An unauthenticated client can then reuse an authentication-server connection already authenticated by another user, receive that user's identity through `authResponseHeaders`, and access the backend as that user. The patched versions apply the same isolation to `Proxy-Authorization`.

Traefik v3.0 through v3.6 are end-of-life and are also affected; they will not receive a fix on their own line. As a workaround, set `authRequestHeaders` to a list that does not include `Proxy-Authorization`.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.62
- https://github.com/traefik/traefik/releases/tag/v3.7.18
- https://github.com/traefik/traefik/releases/tag/v3.8.0-rc.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_