Exploit for Incorrect Authorization in Traefik

CVE-2026-88008 — Traefik: unauthorised h2c upgrade tunnels pas...

Exploit for Authorization Bypass Through User-Controlled Key in Traefik

CVE-2026-88877 — Traefik v3.7.0–v3.7.11 — Authentication b...

CVE-2026-88010

creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:06+00:00| published-proof-of-concept| https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6 2026-09-22 23:31:56+00:00| seen| https://gist.github.com/alon710/af64fb0e4974981b0997528347311521 2026-09-23 00:00:39+00:00...

GHSA-8FCF-V89G-XPG6 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Summary Traefik's BasicAuth middleware coalesces concurrent credential checks through a singleflight.Group to avoid hashing the same password many times at once. Since v3.6.11 the deduplication key was built from the submitted password plus the stored secret, so it depended on server state: a...

CVE-2026-88011

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. A remote attacker can exploit this vulnerability by sending a specially crafted dot-form header, such as X.Authenticated.User. Due to a discrepancy in how Go and certain backend systems like CGI, WSGI, PHP, and NGIN...

CVE-2026-88010

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88004

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its entrypoint defenses, designed to sanitize header names, failed to inspect request trailers. This allowed an unauthenticated client to submit malicious header names within HTTP/1.1 chunked or HTTP/2 trailers...

CVE-2026-88012

A flaw was found in Traefik, an open-source HTTP reverse proxy and load balancer. Its HTTP/3 entrypoints do not correctly apply read timeouts, which are intended to prevent prolonged connections. An unauthenticated client can exploit this by sending a slow request body, continuously trickling dat...

CVE-2026-88008

A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP/2 request that includes specific upgrade headers. If the backend server accepts the upgrade, Traefik enters a raw...

CVE-2026-88007

A flaw in Traefik's HTTP/3 ConnContext allows unauthenticated remote attackers to bypass authentication on backends using connection-bound NTLM or Negotiate protocols. Missing service.AddTransportOnContext calls lead to shared kerberosRoundTripper transports, enabling attackers to hijack persiste...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

EUVD-2026-84532

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-88010

Traefik (open source HTTP reverse proxy and load balancer) versions 3.6.11 through before 3.7.13 contain an unauthenticated username-enumeration timing oracle in the BasicAuth middleware. The checkPassword function in pkg/middlewares/auth/basic_auth.go constructs the singleflight key from the sub...

CVE-2026-88009

A flaw was found in Traefik, an open source HTTP reverse proxy and load balancer. This vulnerability allows a remote attacker to bypass security controls by sending a specially crafted HTTP/1 request. The request target is incorrectly processed, leading to cross-vhost routing bypass, path-scoped...

PT-2026-96813

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.11 through 3.7.12 Description An unauthenticated timing discrepancy exists in the checkPassword function within pkg/middlewares/auth/basic auth.go. The issue occurs because the BasicAuth singleflight key is constructed usi...

CVE-2026-88010: Observable Timing Discrepancy

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

SUSE CVE-2026-88004

Traefik is an open source HTTP reverse proxy and load balancer. From 3.2.0 until 3.7.13, Traefik entrypoint defenses aliasHeadersStrategy, underscoreHeadersStrategy, and forwardedHeaders inspect req.Header but not req.Trailer, allowing an unauthenticated client to submit an aliasing or trusted...