GHSA-p956-6gvv-mxqp

There is a high severity authentication vulnerability in Traefik's ForwardAuth middleware when the authentication server uses a connection-bound scheme such as NTLM or SPNEGO/Kerberos "Negotiate". The fix for GHSA-hrpp-p4fc-wwf8 sends the subrequests of a client that presents such a credential on a dedicated connection to the authentication server, but it only detects the credential in the Authorization header. ForwardAuth also forwards the Proxy-Authorization header, and a credential sent in that header still goes through the connection pool shared by every client. An unauthenticated client can then reuse an authentication-server connection already authenticated by another user, receive that user's identity through authResponseHeaders, and access the backend as that user. The patched versions apply the same isolation to Proxy-Authorization.