AIKIDO-2026-888707

TL;DR

Traefik's ForwardAuth middleware sends each client's authentication subrequest to the configured auth server over a connection pool shared by all clients of the middleware. When that auth server uses NTLM or Negotiate authentication bound to the connection, as IIS Windows Authentication does, an unauthenticated client on a separate frontend connection can reuse a connection already authenticated for a victim and receive the victim's identity through authResponseHeaders, reaching backends as that user. The fix wraps the auth server client with service.NewKerberosRoundTripper, so each frontend connection uses its own transport.