CVE-2026-41263
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
How to fix
- traefik traefik2.11.43, 3.6.14 or later
- github.com/traefik/traefik/v33.7.0-rc.2, 3.6.14 or later
- github.com/traefik/traefik/v22.11.43 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik traefik | v < 2.11.43, 3.0.0 ≤ v < 3.6.14, 3.7.0 | 2.11.43, 3.6.14 |
| github.com/traefik/traefik/v3Go | 3.7.0-ea.1 ≤ v < 3.7.0-rc.2, 3.0.0-beta1 ≤ v < 3.6.14 | 3.7.0-rc.2, 3.6.14 |
| github.com/traefik/traefik/v2Go | v < 2.11.43 | 2.11.43 |
| github.com/traefik/traefikGo | v ≤ 1.7.34, No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.