Traefik versions prior to 2.11.60 and 3.7.16 send ForwardAuth or NGINX auth-url subrequests through a shared auth‑server connection pool. This design exposes connection‑bound NTLM or Negotiate authentication state. An unauthenticated attacker can hijack a different user's authenticated connection, receiving the victim’s identity through authResponseHeaders and using it to access backends as that user. The result is unauthorized access.

Traefik 2.x before 2.11.60 and Traefik 3.x before 3.7.16 are affected. The vulnerability arises from the shared authentication connection pool used by ForwardAuth and, in 3.x, by ingress NGINX auth-url requests.

The CVSS score of 7 indicates moderate‑to‑high severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector involves a network attacker with access to the Traefik instance that has ForwardAuth enabled; no special credentials are required. Because the flaw leaks authentication information across connections, exploitation is straightforward once the attacker can inject a ForwardAuth subrequest.