CVE-2026-121966
Last modified
CVE-2026-121966 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user..
Description
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backends as that user.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| traefik | traefik | < 2.11.60 |
| traefik | traefik | >= 3.0.0, < 3.7.16 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-121966?
How severe is CVE-2026-121966?
How do I fix CVE-2026-121966?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-121960FreeRDP before 3.32.2 contains a denial of service vulnerabi…7.5
- CVE-2026-121961FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…5.9
- CVE-2026-121962FreeRDP before 3.32.2 contains a heap buffer overflow in tra…8.1
- CVE-2026-121963FreeRDP before 3.32.2 contains a use-after-free vulnerabilit…5.9
- CVE-2026-121964FreeRDP before 3.32.2 contains a heap-based buffer overflow …7.5
- CVE-2026-121965Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 …5.3
- CVE-2026-121967Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 b…4.9
- CVE-2026-121968Netrek-client-cow through 3.3.3 contains an out-of-bounds re…6.5
- CVE-2026-121969netrek-client-cow through 3.3.3 contains a stack-based buffe…6.5
- CVE-2026-12197A security flaw has been discovered in Ruijie EG105G-P 2.340…7.3
- CVE-2026-121970Pay with Vipps and MobilePay for WooCommerce (woo-vipps) bef…3.7
- CVE-2026-121971The component ScopingHttpClient in Symfony HttpClient merges…8.2
Are you affected by CVE-2026-121966?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST