CVE-2026-41263: Traefik: BasicAuth middleware: timing side-channel vulnerability

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-30 · updated 2026-06-17
Weakness: CWE-208

Description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Affected products

Traefik: before 2.11.43; from 3.0.0 before 3.6.14; 3.7.0-ea1, 3.7.0-ea2, 3.7.0-ea3, 3.7.0-rc1 — fixed in 2.11.43, 3.6.14

How to fix

Upgrade to a fixed version: Traefik 2.11.43, 3.6.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41263 or the next vulnerability affects your stack