CVE-2026-121966

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121966", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T12:48:39.813Z", "datePublished": "2026-11-04T15:33:28.106Z", "dateUpdated": "2026-11-04T18:17:29.572Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T15:33:28.106Z"}, "datePublic": "2026-10-21T00:00:00.000Z", "title": "Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak", "descriptions": [{"lang": "en", "value": "Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Exposure of Data Element to Wrong Session", "cweId": "CWE-488", "type": "CWE"}]}], "affected": [{"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.11.60"}, {"version": "2.11.60", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "traefik", "product": "traefik", "defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "versions": [{"version": "3.0.0", "status": "affected", "versionType": "semver", "lessThan": "3.7.16"}, {"version": "3.7.16", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.11.60"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0.0", "versionEndExcluding": "3.7.16"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-hrpp-p4fc-wwf8)"}, {"name": "VulnCheck Advisory: Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak"}], "credits": [{"lang": "en", "value": "mosafariuk", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T18:13:59.569753Z", "id": "CVE-2026-121966", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:17:29.572Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-04T18:13:59.569753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:14:07.456Z"}}], "cna": {"title": "Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak", "credits": [{"lang": "en", "type": "finder", "value": "mosafariuk"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "0", "lessThan": "2.11.60", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.60", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "defaultStatus": "unaffected"}, {"vendor": "traefik", "product": "traefik", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.7.16", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.16", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "defaultStatus": "unaffected"}], "datePublic": "2026-10-21T00:00:00.000Z", "references": [{"url": "https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8", "name": "GitHub Security Advisory (GHSA-hrpp-p4fc-wwf8)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak", "name": "VulnCheck Advisory: Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-488", "description": "Exposure of Data Element to Wrong Session"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.11.60"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "3.7.16", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T15:33:28.106Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121966", "state": "PUBLISHED", "dateUpdated": "2026-11-04T18:17:29.572Z", "dateReserved": "2026-11-04T12:48:39.813Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T15:33:28.106Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v2", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "2.11.60", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.11.60", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:golang/github.com/traefik/traefik/v3", "product": "traefik", "vendor": "traefik", "versions": [{"lessThan": "3.7.16", "status": "affected", "version": "3.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "3.7.16", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user."}], "id": "CVE-2026-121966", "lastModified": "2026-11-04T19:17:38.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121966", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T18:13:59.569753Z", "version": "2.0.3"}}]}, "published": "2026-11-04T16:17:50.107", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-488"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/traefik/traefik: Traefik: Unauthorized access via shared authentication connection pool", "id": "2567741", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567741"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-488", "details": ["Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.", "A flaw was found in Traefik. The ForwardAuth middleware routes authentication requests through a connection pool shared across all clients, failing to isolate connection-bound authentication protocols such as NT LAN Manager (NTLM) or Negotiate. An unauthenticated remote attacker could exploit this issue by reusing another user's authenticated connection, allowing them to impersonate legitimate users and gain unauthorized access to backend services."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-121966", "public_date": "2026-11-04T15:33:28Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121966\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121966\nhttps://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8\nhttps://www.vulncheck.com/advisories/traefik-before-2.11.60-and-3.7.16-forwardauth-ntlm-negotiate-identity-leak"], "statement": "This vulnerability is rated as Important severity because unauthenticated remote attackers can hijack existing authenticated sessions across trust boundaries, potentially compromising the confidentiality and integrity of backend services. Exploitation requires specific architectural preconditions, namely configuring ForwardAuth or Ingress authentication URL mechanisms alongside connection-oriented authentication schemes like NTLM or Negotiate. Deployments utilizing stateless or token-based authentication models are not vulnerable to this session reuse issue. Furthermore, Traefik is not distributed or enabled by default in Red Hat enterprise products.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.11.60)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[2.11.60,*]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.7.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.7.16,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0,3.7.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[3.7.16,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "traefik", "source": "cna", "vendor": "traefik"}, "product": "traefik", "vendor": "traefik"}], "created": "2026-11-04T16:45:07.562878+00:00", "updated": "2026-11-04T17:15:14.802560+00:00", "vendors": ["traefik", "traefik$PRODUCT$traefik"]}