AIKIDO-2026-894731

github.com/traefik/traefik/v3 is vulnerable to Exposure of Data Element to Wrong Session

CVE-2026-121966Published 3 days ago

CVE Score

High

Exposure of Data Element to Wrong Session

TL;DR

Before the fix, Traefik's ForwardAuth middleware sent each client's authentication subrequest to the configured auth server over a connection pool shared by all clients of the middleware. When that auth server used connection-bound NTLM or Negotiate authentication (as IIS Windows Authentication does), an unauthenticated client on a separate frontend connection could reuse a connection already authenticated for a victim and receive the victim's identity through authResponseHeaders, reaching backends as that user. On 3.7 releases that include the Ingress NGINX provider, its auth-url external requests were exposed the same way. The fix dedicates an auth-server transport to each frontend connection through kerberos.NewRoundTripper.

How do I fix this?

Upgrade the github.com/traefik/traefik/v3 package to 3.7.16 or later.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and configure the ForwardAuth middleware against an authentication server using connection-bound NTLM or Negotiate authentication, with the endpoint reachable to unauthenticated clients.