CVE-2026-41263
published 2026-04-30CVE-2026-41263: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in…
PriorityP418low3.7CVSS 3.1
AVNACHPRNUINSUCLINAN
EPSS
0.37%
28.7th percentile
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devspaces | traefik-rhel9 | — | — |
| github.com | traefik_traefik | 0 – 1.7.34 | — |
| github.com | traefik_traefik_v2 | >= 0 < 2.11.43 | 2.11.43 |
| github.com | traefik_traefik_v3 | >= 3.0.0-beta1 < 3.6.14 | 3.6.14 |
| github.com | traefik_traefik_v3 | >= 3.7.0-ea.1 < 3.7.0-rc.2 | 3.7.0-rc.2 |
| traefik | traefik | < 2.11.43 | 2.11.43 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
| traefik | traefik | >= 3.0.0 < 3.6.14 | 3.6.14 |
CVSS provenance
nvdv3.13.7LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.3MEDIUM
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik BasicAuth Middleware timing discrepancy
vuldb·2026-04-25
CVE-2026-41263 [LOW] Traefik BasicAuth Middleware timing discrepancy
A vulnerability classified as problematic has been found in Traefik. This affects an unknown part of the component BasicAuth Middleware. The manipulation leads to observable timing discrepancy.
This vulnerability is listed as CVE-2026-41263. The attack may be initiated remotely. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware
ghsa·2026-04-24·CVSS 6.3
CVE-2026-41263 [MEDIUM] CWE-208 Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware
Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware
## Summary
There is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.
The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.
## Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.43
- https://github.com/traefik/traefik/releases/tag/v3.6.14
- ht
Red Hat
github.com/traefik/traefik: Traefik: Username enumeration via timing side-channel in BasicAuth middleware
vendor_redhat·2026-04-30·CVSS 6.3
CVE-2026-41263 [MEDIUM] CWE-208 github.com/traefik/traefik: Traefik: Username enumeration via timing side-channel in BasicAuth middleware
github.com/traefik/traefik: Traefik: Username enumeration via timing side-channel in BasicAuth middleware
A flaw was found in Traefik. A remote attacker can exploit a timing side-channel vulnerability in Traefik's BasicAuth middleware. This flaw allows an attacker to enumerate valid usernames by observing differences in authentication response times. The vulnerability arises because a constant-time comparison, intended to prevent such attacks, short-circuits, revealing whether a username exists.
Mitigation: To mitigate this issue, restrict network access to Traefik instances that utilize the BasicAuth middleware. Implement firewall rules or network access controls to limit connections to trusted networks or clients only. This reduces the exposure to remote attackers attempting username e
No detection rules found.
No public exploits indexed.
2026-04-30
Published