Is CVE-2026-121966 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121966 being exploited in the wild.

How severe is CVE-2026-121966?

High severity, with a CVSS score of 8.7, published 4 November 2026.

Which products and versions are affected?

Traefik 2.x before 2.11.60; 3.0.0 to 3.7.15.

Is there a fix for CVE-2026-121966?

Yes: fixed in Traefik 2.11.60, 3.7.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121966 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-121966?

Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121966: Traefik ForwardAuth connection pool identity leak via NTLM/Negotiate

CVE-2026-121966 · Severity: high · CVSS 8.7 · Published 2026-11-04

Traefik is a reverse proxy and load balancer used to route traffic to backend services. When ForwardAuth middleware uses NTLM or Negotiate authentication, the system reuses authenticated connections across different clients, allowing an attacker to impersonate another user and access protected backends with that user's identity and permissions.

Technologies: Traefik. Vendors: Traefik.

Quick answers

Is CVE-2026-121966 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121966 being exploited in the wild.
How severe is CVE-2026-121966?: High severity, with a CVSS score of 8.7, published 4 November 2026.
Which products and versions are affected?: Traefik 2.x before 2.11.60; 3.0.0 to 3.7.15.
Is there a fix for CVE-2026-121966?: Yes: fixed in Traefik 2.11.60, 3.7.16. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121966 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-121966?: Check whether you run Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Traefik 2.11.60, 3.7.16

Technical details

Traefik's ForwardAuth middleware maintains a shared connection pool to the authentication server across all clients, rather than isolating connections per frontend connection. When the auth server uses connection-bound schemes like NTLM or SPNEGO/Kerberos Negotiate, an unauthenticated attacker can cause their auth request to reuse a connection already authenticated by a victim, receiving the victim's identity through authResponseHeaders. In Traefik 3.7, the same flaw exists in Ingress NGINX provider's auth-url requests.

Affected products

Traefik Traefik 2.x before 2.11.60; 3.0.0 to 3.7.15

Timeline

2026-10-21: disclosed
2026-11-04: advisory
2026-10-21: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.