CVE-2026-41263
Low · 3.7CVSS
3.7
EPSS
0.4%
Published
Apr 30, 2026
CISA due date
—
The record
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | traefik | 0 | 3.6.15-1.1 |
| openSUSE:Tumbleweed | traefik2 | 0 | 2.11.44-1.1 |
Related vulnerabilities
- CVE-2026-48491 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-53622 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-48020 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-44774 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-41181 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-41174 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-35051 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik
- CVE-2026-39858 Traefik is an HTTP reverse proxy and load balancer. Also affects traefik