Traefik has disclosed a high-severity vulnerability in its ForwardAuth middleware that can let one client’s authenticated identity leak into another client’s request. The issue is tracked as GHSA-hrpp-p4fc-wwf8 and was published on October 21, 2026 by Traefik maintainer mmatur through the project’s official GitHub Security Advisory. No CVE identifier has been assigned to this advisory.
The advisory rates the bug as High severity, with a CVSS v4 base score of 7.0 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N). It affects the traefik/traefik Go module: v2 releases up to and including v2.11.59, and v3 releases from v3.0.0 through v3.7.15. Fixes are available in v2.11.60 and v3.7.16.
How the ForwardAuth leak happens
Traefik’s ForwardAuth middleware works by sending a sub-request to an external authentication server before letting the real request through. According to the advisory, those sub-requests travel through a connection pool shared by every client Traefik serves, instead of one isolated per client.
That sharing is harmless when the authentication server uses a stateless scheme, since each sub-request carries its own credentials. The problem shows up when the auth server instead relies on a connection-bound authentication scheme, such as NTLM or SPNEGO/Kerberos Negotiate. Both are negotiated once per TCP connection and then trusted for every later request on that same connection, which is exactly how IIS Windows Authentication is commonly deployed.
Because Traefik can reuse a pooled connection that was already authenticated for one user, an unrelated, unauthenticated client arriving on a completely separate frontend connection can have its ForwardAuth sub-request answered on that same already-authenticated connection. The auth server replies as if it were still talking to the original user, and Traefik forwards that identity to the backend through authResponseHeaders. In practice, a second client can then reach the protected backend under the first user’s identity, without ever supplying valid credentials of their own.
The advisory also notes a second variant specific to Traefik v3.7: the same shared-pool behavior affects the external authentication calls Traefik makes for the auth-url annotation used by the Kubernetes Ingress NGINX provider. The fix in v3.7.16 extends the per-frontend-connection isolation that an earlier patch had applied to backend proxy paths, so it now also covers requests sent to the authentication server itself.
Who needs to act
This bug only matters when ForwardAuth is paired with a connection-bound authentication backend. If a Traefik instance uses ForwardAuth against an OAuth2 proxy, Authelia, Authentik, or any other scheme that authenticates each request independently, this particular issue doesn’t apply. NTLM and Kerberos Negotiate show up far more often in corporate environments sitting in front of IIS or Active Directory-integrated services than in a typical self-hosted homelab. Most home setups that use Traefik purely as a Docker-label-driven reverse proxy in front of apps like Jellyfin, Immich, or Nextcloud are unlikely to be exposed through this specific path.
That said, upgrading costs nothing and closes the hole regardless of whether it’s currently exploitable in a given setup. Traefik users should:
- Check the running version with
traefik versionor by inspecting the Docker image tag, and confirm it’s at least v2.11.60 or v3.7.16. - Pull the updated image (
traefik:v2.11.60,traefik:v3.7.16, ortraefik:latestonce it rolls over) and redeploy. - Review whether any ForwardAuth middleware in the configuration points at an authentication server using NTLM or Negotiate, since that’s the only configuration this advisory actually affects.
- Remember that Traefik v3.0 through v3.6 are end-of-life and won’t receive a backport; anyone still on those releases needs to move up to v2.11.60 or v3.7.16 rather than wait for a point release.
Anyone running Traefik as a reverse proxy for self-hosted services can find setup and configuration details, including the ForwardAuth middleware, in SelfHostLab’s Traefik guide. Full technical details, including the complete CVSS vector and the maintainer’s write-up, are available in the original GitHub Security Advisory.