CVE-2026-121966

EUVD-2026-116966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
8.7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
traefiktraefik
𝑥
< 2.11.60
CNA
traefiktraefik
3.0.0 ≤
𝑥
< 3.7.16
CNA
Common Weakness Enumeration
References
https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak