GHSA-6x2q-h3cr-8j2h CVE-2026-41263 GO-2026-5195

Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware

Low Go

Severity: 0.0 / 10; Low · CVSS 4.0
Exploit chance (EPSS): 0.37%; Chance of exploitation in the next 30 days. Higher than 30.80% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-208 Observable Timing Discrepancy
Fix: Available; 2 packages have a fixed version

Description

Summary

There is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.

The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.

Patches

For more information

If there are any questions or comments about this advisory, please open an issue.

<details> <summary>Original Description</summary>

BasicAuth Timing Regression: CVE-2026-32595 Fix Is a No-Op Due to Map Key/Value Confusion

TL;DR

The patch for CVE-2026-32595 is a no-op. Line 49 of basic_auth.go has a map key/value confusion that makes notFoundSecret always "". The "constant time" fallback calls goauth.CheckSecret(password, ""), which fast-fails in ~1us instead of running bcrypt (~60ms).

Evidence (HEAD `786f7192e`, 2026-04-09)

Black-box PoC against live traefik binary on port 28080:

bucket	n	median	min
existing user (wrong pw)	240	62.85 ms	57.54 ms
nonexistent user (wrong pw)	400	0.48 ms	0.35 ms

Median ratio: 130.4x. Classification: 8/8 correct.

Go in-tree test: goauth.CheckSecret direct ratio 12,746x.

Root cause (4-step trace)

basic_auth.go:49: users[slices.Collect(maps.Values(users))[0]] -- looks up a hash as a username key, returns "".
basic_auth.go:119-120: calls goauth.CheckSecret(password, "").
go-http-auth/basic.go:87: empty string matches no prefix, falls to default compareMD5HashAndPassword.
basic.go:107-109: bytes.SplitN("", "$", 4) returns length 1, function returns instantly.

Files

poc/exploit.py -- black-box Python timing oracle
poc/basic_auth_timing_regression_test.go -- Go in-tree test
poc/traefik.yml + poc/dynamic.yml -- traefik config
poc/live_http_poc_output_head.txt -- verbatim PoC output on HEAD

Koda Reef

</details>

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/traefik/traefik	`<= 1.7.34`	No fix yet
github.com/traefik/traefik	`all versions`	No fix yet
github.com/traefik/traefik/v2	`< 2.11.43`	`2.11.43`
github.com/traefik/traefik/v3	`>= 3.7.0-ea.1, < 3.7.0-rc.2`	`3.7.0-rc.2`
github.com/traefik/traefik/v3	`>= 3.0.0-beta1, < 3.6.14`	`3.6.14`
github.com/traefik/traefik/v3	`>= 3.0.0-beta1, < 3.6.14` `>= 3.7.0-ea.1, < 3.7.0-rc.2`	`3.6.14` `3.7.0-rc.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/traefik/traefik/v2 Go → `2.11.43`

go

go get github.com/traefik/traefik/v2@v2.11.43 && go mod tidy

github.com/traefik/traefik/v3 Go → `3.7.0-rc.2`

go

go get github.com/traefik/traefik/v3@v3.7.0-rc.2 && go mod tidy

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): Low
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Weakness

CWE-208: Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2026-41263

Packages

github.com/traefik/traefik

Timeline

Apr 24, 2026 Published
Jun 25, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle	Medium	Also affects github.com/traefik/traefik
GHSA-f52w-8j3h-j724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging	High	Also affects github.com/traefik/traefik
GHSA-w4v4-9rw7-5326 Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization	Critical	Also affects github.com/traefik/traefik
GHSA-qqjf-53cj-pwvv Traefik HTTP/3 Backend NTLM Connection Reuse	Critical	Also affects github.com/traefik/traefik
GO-2026-6467 Traefik entrypoint header-name sanitization bypassed via request trailers	High	Also affects github.com/traefik/traefik
GHSA-rf44-j88r-hh8c Traefik: ForwardAuth identity spoofing via dot-form header alias	High	Also affects github.com/traefik/traefik
GHSA-7ghq-v6jf-g56c Traefik: respondingTimeouts.readTimeout is not applied to HTTP/3, leaving slow-body uploads unbounded	Medium	Also affects github.com/traefik/traefik
GHSA-62fc-8686-hfmq Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef	Medium	Also affects github.com/traefik/traefik

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor