Traefik ForwardAuth shared connections leak user identity (NTLM/Negotiate)
Traefik, a web gateway program, can let attackers borrow other users' logins.
Summary
Traefik's ForwardAuth sends authentication requests through a connection pool shared by all clients, so an unauthenticated attacker can reuse another user's connection, receive that user's identity, and access backends as them. Setups where the auth server uses NTLM or Negotiate are affected.
Affected when
- ForwardAuth middleware in use
- auth server uses NTLM or Negotiate (e.g., IIS Windows Authentication)
What to do
Update to Traefik 2.11.60 or 3.7.16 or later. Versions 3.0 through 3.6 are end-of-life, so upgrade to one of these.
Update to at least the version for your product:
- Traefik v2 2.11.60 or later
- Traefik v3 3.7.16 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen