Vulnerability record/PUBLISHED/Published Nov 4, 2026 15:33:28 UTC
CVE-2026-121966
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
Base score7.0/ 10
SeverityHighCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityLowAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityNoneVC
Vulnerable system integrityNoneVI
Vulnerable system availabilityNoneVA
Subsequent system confidentialityHighSC
Subsequent system integrityHighSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 4, 2026 18:17:29 UTC
PublishedNov 4, 2026 15:33:28 UTC
ReservedNov 4, 2026 12:48:39 UTC
Credits
- mosafariuk