CVE-2026-121966
Description
A flaw was found in Traefik. The ForwardAuth middleware routes authentication requests through a connection pool shared across all clients, failing to isolate connection-bound authentication protocols such as NT LAN Manager (NTLM) or Negotiate. An unauthenticated remote attacker could exploit this issue by reusing another user's authenticated connection, allowing them to impersonate legitimate users and gain unauthorized access to backend services.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can hijack existing authenticated sessions across trust boundaries, potentially compromising the confidentiality and integrity of backend services. Exploitation requires specific architectural preconditions, namely configuring ForwardAuth or Ingress authentication URL mechanisms alongside connection-oriented authentication schemes like NTLM or Negotiate. Deployments utilizing stateless or token-based authentication models are not vulnerable to this session reuse issue. Furthermore, Traefik is not distributed or enabled by default in Red Hat enterprise products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
--- CME Mitigation Guidance (2026-11-06) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to isolate authentication subrequest connections per client or disable connection pooling for connection-bound authentication protocols in Traefik ForwardAuth and Ingress auth-url handling: upgrade to Traefik 2.11.60, 3.7.16, which isolates authentication subrequest connections to prevent reusing connection-bound NTLM or Negotiate authenticated connections across different client sessions, closing all 2 injection vectors (ForwardAuth middleware subrequest connection reuse, Kubernetes Ingress NGINX auth-url connection reuse). Until patched, this is only a concern on Traefik deployments using ForwardAuth or Kubernetes Ingress NGINX auth-url with connection-bound authentication schemes like NTLM or Negotiate — Deployments utilizing stateless or token-based authentication models are unaffected — so Switch upstream authentication services to stateless or token-based schemes rather than connection-bound protocols, or restrict network access to the Traefik proxy endpoint. These controls limit blast radius and contain exploitation, but they do not fix the underlying shared authentication connection pool reuse defect — apply the upstream patch to fully remediate.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Data can "bleed" from one session to another through member variables of singleton objects, such as Servlets, and objects from a shared pool. Storing user data in Servlet member fields introduces a data access race condition.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
