Hi everyone,
We have released new security updates for Traefik Proxy: 2.11.60 and 3.7.16.
These releases fix the following security advisories:
- [High] GHSA-hrpp-p4fc-wwf8: when ForwardAuth delegates to an authentication server using NTLM or Kerberos (Negotiate), a client could reuse an auth-server connection already authenticated by another user and reach the backend with that user's identity; in 3.7 this also applies to the Ingress NGINX provider's auth-url annotation. Fixed in 2.11.60 and 3.7.16.
ForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clients · Advisory · traefik/traefik · GitHub
Release notes:
Traefik v3.0 through v3.6 are end of life and will not receive a patch; users on those versions should upgrade to 3.7.16.
We strongly recommend upgrading as soon as possible.
The Traefik team