Traefik BasicAuth Middleware Vulnerability in Traefik HTTP Reverse Proxy
CVE-2026-71326

2.1LOW

Key Information:

Vendor

Traefik

Status
Traefik
Vendor
CVE Published:
6 August 2026

What is CVE-2026-71326?

A vulnerability in the BasicAuth middleware of Traefik allows attackers with valid credentials to authenticate as an unconfigured username. This is possible due to the deduplication of concurrent password checks, which relies on unsafe credential handling in certain versions of Traefik. The issue has been addressed in versions 3.6.25 and 3.7.10, ensuring enhanced security measures to prevent unauthorized access.

Affected Version(s)

traefik >= 3.6.11, < 3.6.25 < 3.6.11, 3.6.25

traefik >= 3.7.0, < 3.7.10 < 3.7.0, 3.7.10

References

https://github.com/traefik/traefik/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/traefik/traefik/pull/13572
x_refsource_MISC
https://github.com/traefik/traefik/commit/b5ace8eb5d67799...
x_refsource_MISC

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.