CVE-2026-121966

High

Description

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.

SeverityHigh

CVSS8.7

Exploit probability—

Product

Traefik

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-488CWE-488

How to fix

Update

Traefik Traefik2.11.60, 3.7.16 or later

Vendor advisories

github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8

Affected products

Product	Affected versions	Fixed in
Traefik Traefik	2.x ≤ v, 3.x ≤ v	2.11.60, 3.7.16

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.