# New Security Update for Traefik 2.11 (2.11.60) and 3.7 (3.7.16)

**URL:** <https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-60-and-3-7-3-7-16/30291>\
**Category:** Announcements\
**Created:** [October 21, 2026, 12:05pm UTC](https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-60-and-3-7-3-7-16/30291 "2026-10-21T12:05:18Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevinpollet](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/kevinpollet/32/1755_2.png) [@kevinpollet](https://community.traefik.io/u/kevinpollet)\
**Post date:** [October 21, 2026, 12:05pm UTC](https://community.traefik.io/t/new-security-update-for-traefik-2-11-2-11-60-and-3-7-3-7-16/30291/1 "2026-10-21T12:05:18Z")

</div>

Hi everyone,

We have released new security updates for Traefik Proxy: 2.11.60 and 3.7.16.

These releases fix the following security advisories:

- [High] GHSA-hrpp-p4fc-wwf8: when ForwardAuth delegates to an authentication server using NTLM or Kerberos (Negotiate), a client could reuse an auth-server connection already authenticated by another user and reach the backend with that user's identity; in 3.7 this also applies to the Ingress NGINX provider's auth-url annotation. Fixed in 2.11.60 and 3.7.16.  
[ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients · Advisory · traefik/traefik · GitHub](https://github.com/traefik/traefik/security/advisories/GHSA-hrpp-p4fc-wwf8)

Release notes:

- [Release v2.11.60 · traefik/traefik · GitHub](https://github.com/traefik/traefik/releases/tag/v2.11.60)
- [Release v3.7.16 · traefik/traefik · GitHub](https://github.com/traefik/traefik/releases/tag/v3.7.16)

Traefik v3.0 through v3.6 are end of life and will not receive a patch; users on those versions should upgrade to 3.7.16.

We strongly recommend upgrading as soon as possible.

The Traefik team