# Traefik Patches High-Severity ForwardAuth Identity Leak

DevFeed: [Traefik Patches High-Severity ForwardAuth Identity Leak](<https://devfeed.tech/articles/traefik-patches-high-severity-forwardauth-identity-leak-98673.md>)

Original publisher: [Read original article](<https://selfhostlab.io/traefik-forwardauth-identity-leak-patch/>)

Author: Christian Rakoot

Published: 2026-10-24T06:22:21Z

Content type: news

Language: en

Sources: [Self Host Lab](<https://devfeed.tech/sources/self-host-lab.md>)

Topics: [traefik](<https://devfeed.tech/topics/traefik.md>), [CVSS v4.0](<https://devfeed.tech/topics/cvss-v4-0.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [patches](<https://devfeed.tech/topics/patches.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [active-directory](<https://devfeed.tech/tags/active-directory.md>), [annotation](<https://devfeed.tech/tags/annotation.md>), [client](<https://devfeed.tech/tags/client.md>), [cve](<https://devfeed.tech/tags/cve.md>), [github](<https://devfeed.tech/tags/github.md>), [github-security](<https://devfeed.tech/tags/github-security.md>), [identifier](<https://devfeed.tech/tags/identifier.md>), [identity](<https://devfeed.tech/tags/identity.md>), [issue](<https://devfeed.tech/tags/issue.md>), [leak](<https://devfeed.tech/tags/leak.md>), [middleware](<https://devfeed.tech/tags/middleware.md>), [network-security](<https://devfeed.tech/tags/network-security.md>), [network-security-news](<https://devfeed.tech/tags/network-security-news.md>), [news](<https://devfeed.tech/tags/news.md>), [october](<https://devfeed.tech/tags/october.md>), [patches](<https://devfeed.tech/tags/patches.md>), [published](<https://devfeed.tech/tags/published.md>), [request](<https://devfeed.tech/tags/request.md>), [security](<https://devfeed.tech/tags/security.md>), [security-advisory](<https://devfeed.tech/tags/security-advisory.md>), [traefik](<https://devfeed.tech/tags/traefik.md>), [traefik-vulnerability](<https://devfeed.tech/tags/traefik-vulnerability.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Traefik's ForwardAuth can pass one user's identity to another client when its shared connection pool reuses a connection authenticated with connection-bound schemes such as NTLM or Kerberos Negotiate. The advisory rates the issue High (CVSS v4 7.0); affected releases are v2 through 2.11.59 and v3.0.0 through 3.7.15, with fixes in v2.11.60 and v3.7.16. In Traefik v3.7, the same pool issue also affects authentication calls made for the Kubernetes Ingress NGINX provider's `auth-url` annotation. The issue does not apply to per-request authentication schemes such as OAuth2 proxy, Authelia, or Authentik. The excerpt recommends checking the running version and upgrading; v3.0-v3.6 are end-of-life and have no backport.

## Source excerpt

Traefik has disclosed a high-severity vulnerability in its ForwardAuth middleware that can let one client's authenticated identity leak into another client's request. The issue is tracked as GHSA-hrpp-p4fc-wwf8 and was published on October 21, 2026 by Traefik maintainer mmatur through the project's official GitHub Security Advisory. No CVE identifier has been assigned to this advisory. [...]