Timing Discrepancy in Traefik HTTP Proxy and Load Balancer

CVE-2026-88010

What is CVE-2026-88010?

Traefik, an open-source HTTP reverse proxy and load balancer, contains a timing discrepancy vulnerability that allows attackers to infer the existence of usernames. In versions 3.6.11 to 3.7.13, the BasicAuth logic constructs keys that coalesce for absent usernames, while separate password hashes are generated for existing usernames. This results in a predictable timing difference, enabling unauthorized users to ascertain which usernames are valid without breaching authentication. The issue can be mitigated by upgrading to version 3.7.13 where the vulnerability is addressed. Traefik v2 and Digest authentication methods remain unaffected.

References