CVE-2026-121966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7…
- Risk score
- 67/100
- CVSS
- 8.7 v3.1
- Published
- 4 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Traefik 2.x before 2.11.60 and 3.x before 3.7.16 has a vulnerability where an attacker can reuse another user's authenticated connection, allowing them to access backends as that user. This is due to the ForwardAuth subrequests and Ingress NGINX auth-url requests being sent through a shared connection pool.
- Affected
- {'products': ['Traefik'], 'packages': [], 'versions': ['2.x before 2.11.60', '3.x before 3.7.16']}
- Fix
- Upgrade to Traefik 2.11.60 or later, or 3.7.16 or later
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.7 high
- Remotely exploitable without logging in
- On your watchlist: nginx
References
Original description
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
Last activity 4 Nov 2026. Patch Forecast updates every hour.