EUVD-2026-26433
GHSA-6x2q-h3cr-8j2h
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionGitHub Advisory
Summary
There is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.
The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.43
- https://github.com/traefik/traefik/releases/tag/v3.6.14
- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2
For more information
If there are any questions or comments about this advisory, please open an issue.
<details> <summary>Original Description</summary>
BasicAuth Timing Regression: CVE-2026-32595 Fix Is a No-Op Due to Map Key/Value Confusion
TL;DR
The patch for CVE-2026-32595 is a no-op. Line 49 of basic_auth.go has a map key/value confusion that makes notFoundSecret always "". The "constant time" fallback calls goauth.CheckSecret(password, ""), which fast-fails in ~1us instead of running bcrypt (~60ms).
Evidence (HEAD 786f7192e, 2026-04-09)
Black-box PoC against live traefik binary on port 28080:
| bucket | n | median | min |
|---|---|---|---|
| existing user (wrong pw) | 240 | 62.85 ms | 57.54 ms |
| nonexistent user (wrong pw) | 400 | 0.48 ms | 0.35 ms |
Median ratio: 130.4x. Classification: 8/8 correct.
Go in-tree test: goauth.CheckSecret direct ratio 12,746x.
Root cause (4-step trace)
basic_auth.go:49:users[slices.Collect(maps.Values(users))[0]]-- looks
up a hash as a username key, returns "".
basic_auth.go:119-120: callsgoauth.CheckSecret(password, "").go-http-auth/basic.go:87: empty string matches no prefix, falls to default
compareMD5HashAndPassword.
basic.go:107-109:bytes.SplitN("", "$", 4)returns length 1, function
returns instantly.
Files
poc/exploit.py-- black-box Python timing oraclepoc/basic_auth_timing_regression_test.go-- Go in-tree testpoc/traefik.yml+poc/dynamic.yml-- traefik configpoc/live_http_poc_output_head.txt-- verbatim PoC output on HEAD
Koda Reef
</details>
---
AnalysisAI
Traefik's BasicAuth middleware contains a timing side-channel vulnerability that allows attackers to enumerate valid usernames through response-time analysis. A map key/value confusion in the constant-time comparison fallback causes the notFoundSecret variable to always resolve to an empty string, causing authentication checks against non-existent users to complete in microseconds (~0.48ms) instead of performing full bcrypt evaluation (~62ms), creating a 130x timing oracle. Attackers can distinguish existing users from non-existent ones by measuring HTTP response times, enabling account enumeration without credentials.
Technical ContextAI
The vulnerability stems from a failed patch to CVE-2026-32595 (the prior timing vulnerability) in Traefik's BasicAuth middleware. Line 49 of basic_auth.go uses incorrect map indexing syntax users[slices.Collect(maps.Values(users))[0]], which attempts to use a bcrypt hash (the map value) as a username key (map lookup), returning an empty string instead of a valid fallback secret. During authentication, the middleware calls goauth.CheckSecret(password, notFoundSecret) where notFoundSecret is empty. The go-http-auth library's CheckSecret function detects the empty string, skips bcrypt validation, and returns instantly via compareMD5HashAndPassword, which immediately fails when parsing an empty string via bytes.SplitN. This short-circuits the intended constant-time comparison that should consume ~60ms of bcrypt CPU, leaving a measurable timing delta between valid and invalid usernames. The root cause is CWE-208 (Observable Timing Discrepancy) combined with a logic error in the patch implementation.
RemediationAI
Apply vendor-released patches immediately: upgrade to Traefik v2.11.43 or later for v2.x users, v3.6.14 or later for v3.6.x users, or v3.7.0-rc.2 or later (or subsequent stable v3.7 release) for v3.7 users. Patches are available at https://github.com/traefik/traefik/releases/tag/v2.11.43, https://github.com/traefik/traefik/releases/tag/v3.6.14, and https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2. As an interim compensating control, disable BasicAuth middleware in Traefik configuration and replace it with a dedicated identity provider or WAF-layer authentication (such as OAuth2 Proxy or external SSO integration via forward-auth middleware), though this requires application redesign and may impact availability during transition. Alternatively, restrict network access to Traefik's exposed endpoints to trusted IPs only via firewall rules or Traefik's IP allowlist middleware, reducing the attacker population but not eliminating the timing oracle for authorized users. The timing vulnerability cannot be safely mitigated without code changes, as no configuration option disables the affected BasicAuth logic.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: LowShare
External POC / Exploit Code
Leaving vuln.today