Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

🗓️ 24 Apr 2026 20:36:41Reported by GitHub Advisory DatabaseType

Traefik BasicAuth timing side-channel enables username enumeration; fixed in patches v2.11.43, v3.6.14, and v3.7.0-rc.2.

Reporter	Title	Published	Views	Family All 79
FreeBSD	traefik -- Multiple vulnerabilities	19 Mar 202600:00	–	freebsd
attackerkb	CVE-2026-32595	20 Mar 202610:08	–	attackerkb
attackerkb	CVE-2026-41263	30 Apr 202620:39	–	attackerkb
AlpineLinux	CVE-2026-32595	20 Mar 202610:08	–	alpinelinux
AlpineLinux	CVE-2026-41263	30 Apr 202620:39	–	alpinelinux
Chainguard	CVE-2026-32595 vulnerabilities	11 Apr 202614:18	–	cgr
Circl	CVE-2026-32595	20 Mar 202609:44	–	circl
Circl	CVE-2026-41263	24 Apr 202613:35	–	circl
CNNVD	Traefik security vulnerabilities	20 Mar 202600:00	–	cnnvd
CNNVD	Traefik security vulnerabilities	30 Apr 202600:00	–	cnnvd

Vulners

Node

traefik traefikRange≤1.7.34go

traefik traefikRange<2.11.43go

traefik traefikRange3.0.0-beta1–3.6.14go

traefik traefikRange3.7.0-ea.1–3.7.0-rc.2go

Source	Link
github	www.github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h
github	www.github.com/traefik/traefik/releases/tag/v2.11.43
github	www.github.com/traefik/traefik/releases/tag/v3.6.14
github	www.github.com/traefik/traefik/releases/tag/v3.7.0-rc.2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41263
github	www.github.com/advisories/GHSA-6x2q-h3cr-8j2h

06 May 2026 21:24Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.13.7

CVSS 46.3

EPSS0.00392

SSVC