Timing Side-Channel Vulnerability in Traefik's BasicAuth Middleware
CVE-2026-41263
6.3MEDIUM
What is CVE-2026-41263?
Traefik, an HTTP reverse proxy and load balancer, has a timing side-channel vulnerability in its BasicAuth middleware that exposes user enumeration to potential attackers. The flaw arises from a constant-time fallback mechanism that can be circumvented, allowing an attacker to discern valid usernames based on response times from authentication requests. This vulnerability existed in versions of Traefik before 2.11.43, 3.6.14, and 3.7.0-rc.2, but has since been fixed in the updated releases. Addressing this vulnerability is crucial to protect sensitive user information and maintain system integrity.
Affected Version(s)
traefik < 2.11.43 < 2.11.43
traefik >= 3.0.0-beta1, < 3.6.14 < 3.0.0-beta1, 3.6.14
traefik >= 3.7.0-ea.1, < 3.7.0-rc.2 < 3.7.0-ea.1, 3.7.0-rc.2