Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-88010Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Medium 6.3

In plain English

A medium-severity security flaw in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium
Exploit odds (30 days)0.3%top 76.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing discrepancy that reveals whether a username exists. Sequential checks remain cost-equalized, Traefik v2 and Digest authentication are not affected, and the issue does not disclose credentials or bypass authentication. This issue is fixed in version 3.7.13.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGHSA-8fcf-v89g-xpg6
Gogithub.com/traefik/traefikno fix listedGO-2026-6558
Gogithub.com/traefik/traefik/v33.7.13GHSA-8fcf-v89g-xpg6

Affected products (as reported)

VendorProductVersions
traefik traefik >= 3.6.11, < 3.7.13

Weakness: CWE-208 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References