CVE-2026-41263 Details
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
A timing side-channel vulnerability has been identified in the BasicAuth middleware of Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in Traefik versions prior to 2.11.43, 3.6.14, and 3.7.0-rc.2. The issue allows an attacker to enumerate valid usernames by exploiting differences in response times. The vulnerability arises because the variable meant to hold a constant-time fallback secret is always empty, leading to a constant-time comparison that short-circuits in microseconds instead of completing a full bcrypt evaluation. As a result, the vulnerability restores the original timing oracle, enabling the distinction between existing and non-existing users based on authentication response times.
Users can upgrade to Traefik versions 2.11.43, 3.6.14, or 3.7.0-rc.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/traefik/traefik/releases/tag/v2.11.43 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.6.14 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 | [email protected] | ProductRelease Notes |
| https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | < 2.11.43 >= 3.0.0, < 3.6.14 3.7.0 ea1 3.7.0 ea2 3.7.0 ea3 3.7.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | New CVE Received | [email protected] |