Identity Leak Vulnerability in Traefik by Traefik Labs

CVE-2026-121966

What is CVE-2026-121966?

The vulnerability in Traefik occurs when ForwardAuth subrequests are sent through a shared auth-server connection pool across all clients. This design flaw potentially allows an unauthenticated attacker to exploit a connection, enabling them to reuse another user's authenticated session. By capturing connection-bound NTLM or Negotiate authentication information, the attacker can access backends impersonating the victim, posing serious security risks for user identities and sensitive data.

References