CVE-2026-32595 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
A vulnerability exists in Traefik's BasicAuth middleware, allowing for username enumeration through a timing attack. This issue is present in Traefik versions 2.11.40 and earlier, 3.0.0-beta1 to 3.6.10, and 3.7.0-ea.1. The vulnerability arises because when a valid username is submitted, the middleware takes approximately 166 milliseconds to respond due to a bcrypt password comparison. In contrast, responses for non-existent usernames are nearly instantaneous, around 0.6 milliseconds. This significant timing difference, which is observable over the network, enables an unauthenticated attacker to reliably identify valid usernames.
Users can upgrade to Traefik versions 2.11.41, 3.6.11, or 3.7.0-ea.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traefik/traefik/releases/tag/v2.11.41 | [email protected] | Release Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.11 | [email protected] | Release Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2 | [email protected] | Release Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.41 >= 3.0.0, <= 3.6.11 3.7.0 ea1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |