CVE-2026-121966
Awaiting Analysis Awaiting Analysis - Queue

Traefik ForwardAuth Connection Reuse NTLM Authentication Bypass

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121966
EUVD
EUVD-2026-116966

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
traefik traefik 0
traefik traefik 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-488 The product does not sufficiently enforce boundaries between the states of different sessions, causing data to be provided to, or used by, the wrong session.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Traefik versions before 2.11.60 and 3.7.16. It involves the ForwardAuth middleware sending authentication requests through a shared connection pool. An unauthenticated attacker can hijack an authenticated connection from another user, receiving the victim's identity via authResponseHeaders. This allows the attacker to impersonate the victim and access backend services with the victim's privileges.

Impact Analysis

An attacker could impersonate legitimate users, gaining unauthorized access to sensitive data or systems. This could lead to data breaches, unauthorized transactions, or other malicious activities performed under the victim's identity. The impact includes potential loss of confidentiality and integrity of user data and backend services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in non-compliance, legal penalties, and reputational damage due to data breaches or unauthorized disclosures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121966. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...