CVE-2026-71326 Details
Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
A vulnerability exists in Traefik's BasicAuth middleware, specifically in versions 3.6.11 prior to 3.6.25 and 3.7.0 prior to 3.7.10. The issue arises from how the middleware handles concurrent password checks, deduplicating them with a singleflight key derived from the password and secret. This allows an attacker with valid credentials and knowledge of the password hash to authenticate as an unconfigured user when certain header fields trust the forwarded identity. Exploitation requires access to the privileged API, Kubernetes Secrets, or the Docker socket.
Users can upgrade to Traefik versions 3.6.25 or 3.7.10 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| traefik traefik | >= 3.6.11, < 3.6.25 >= 3.7.0, < 3.7.10 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 16, 2026 | Initial Analysis | [email protected] |
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | [email protected] |