Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Traefik ForwardAuth: Identity Leak Risk CVE-2026-121966 impacts Traefik ForwardAuth—NTLM & Negotiate credentials can leak across users via shared auth server connection pool. For more details, read ZeroPath's blog on this vuln. #AppSec #InfoSec #ZeroTrust https://zeropath.com/blog/cve-2026-121966-traefik-forwardauth-ntlm-negotiate-identity-leak