CVE-2026-71326
published 2026-08-06CVE-2026-71326: Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in…
PriorityP415low2.1CVSS 4.0
AVNACLATPPRHUINVCLVILVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.36%
28.8th percentile
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | traefik_traefik_v3 | >= 3.6.11 < 3.6.25 | 3.6.25 |
| github.com | traefik_traefik_v3 | >= 3.7.0 < 3.7.10 | 3.7.10 |
| traefik | traefik | — | — |
| traefik | traefik | — | — |
CVSS provenance
nvdv4.02.1LOWCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Traefik up to 3.6.24/3.7.9 BasicAuth Middleware basic_auth.go improper authentication
vuldb·2026-08-07·CVSS 2.1
CVE-2026-71326 [LOW] Traefik up to 3.6.24/3.7.9 BasicAuth Middleware basic_auth.go improper authentication
A vulnerability described as critical has been identified in Traefik up to 3.6.24/3.7.9. This issue affects some unknown processing of the file pkg/middlewares/auth/basic_auth.go of the component BasicAuth Middleware. The manipulation results in improper authentication.
This vulnerability is cataloged as CVE-2026-71326. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
ghsa·2026-08-06
CVE-2026-71326 [LOW] CWE-287 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
## Summary
There is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured username — whose secret is empty — can produce the same key as a configured user's valid request and receive that request's successful result. Exploitation requires the attacker to already hold a valid credential **and** to read the stored password hash, which is only reachable through paths that are themselves privileged: the API is documented as admin-only, the Kubernetes path requires read access to the Secre
Red Hat
github.com/traefik/traefik: Traefik: Authenticated identity spoofing via BasicAuth key collision
vendor_redhat·2026-08-06·CVSS 2.1
CVE-2026-71326 [LOW] CWE-836 github.com/traefik/traefik: Traefik: Authenticated identity spoofing via BasicAuth key collision
github.com/traefik/traefik: Traefik: Authenticated identity spoofing via BasicAuth key collision
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
A flaw was found in Traefik. The BasicAuth middleware in Traefik reuses a key for concurrent password checks, which is generated by concatenating the password and secret without a delimiter. An att
No detection rules found.
No public exploits indexed.
https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350https://github.com/traefik/traefik/pull/13572https://github.com/traefik/traefik/releases/tag/v3.6.25https://github.com/traefik/traefik/releases/tag/v3.7.10https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf
2026-08-06
Published