Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1061
_____________________________________________________________________

DATE                : 21/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running traefik/v2 (Go) versions prior
                                      to 2.11.60,
                     traefik/v3 (Go) versions prior to 3.7.16.

====================================================================
https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8
https://github.com/traefik/traefik/security/advisories/GHSA-p8wx-ph99-xgcr
_____________________________________________________________________

ForwardAuth shares the auth-server connection pool, leaking
NTLM/Negotiate-bound identity across clients

High	mmatur published GHSA-hrpp-p4fc-wwf8 

Package
 github.com/traefik/traefik/v2 (Go)

Affected versions
<= v2.11.59

Patched versions
v2.11.60

github.com/traefik/traefik/v3 (Go)
Affected versions
>= v3.0.0, <= v3.7.15
Patched versions
v3.7.16


Description

Summary

There is a high severity authentication vulnerability in Traefik's
ForwardAuth middleware when the authentication server uses a
connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate"
(for example IIS Windows Authentication). ForwardAuth sends its
authentication subrequests through a connection pool shared by every
client of the middleware, so an auth-server connection already
authenticated by one user can be reused for the subrequest of an
unrelated client. An unauthenticated client on a separate frontend
connection can then receive a successful authentication response
carrying the victim's identity, which Traefik forwards to the
backend through authResponseHeaders, and access the backend as
that user. In Traefik v3.7 the same applies to the external
authentication requests issued for the Kubernetes Ingress NGINX
provider's auth-url annotation.

This is a distinct issue from GHSA-53qr-784g-cj35, GHSA-qqjf-53cj-pwvv,
GHSA-cw35-4q88-3rmp and GHSA-qm9f-w54v-q2qh, which isolated
connection-bound authentication on the backend proxy paths only;
the fix applies the same per-frontend-connection isolation to the 
server. Traefik v3.0 through v3.6 are end-of-life and are also 
; they will not receive a fix on their own line, and users on
those versions must upgrade to v2.11.60 or v3.7.16.


Patches
https://github.com/traefik/traefik/releases/tag/v2.11.60
https://github.com/traefik/traefik/releases/tag/v3.7.16


For more information
If you have any questions or comments about this advisory, please
open an issue.


Severity
High
7.0/ 10

CVSS v4 base metrics
Exploitability Metrics
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User interaction
None
Vulnerable System Impact Metrics
Confidentiality
None
Integrity
None
Availability
None
Subsequent System Impact Metrics
Confidentiality
High
Integrity
High
Availability
None
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CVE ID
No known CVE

Weaknesses
No CWEs


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================