Traefik: BasicAuth middleware: timing side-channel vulnerability

Summary

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

Timeline

1. Apr 30, 2026, 8:39 PM UTCCVE published
2. May 1, 2026, 2:22 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. May 1, 2026, 2:22 PM UTCRecord last updated

Affected versions

• traefik traefik

  fixed in 2.11.43; From 3.0.0-beta1 · fixed in 3.6.14; From 3.7.0-ea.1 · fixed in 3.7.0-rc.2

• github.com/traefik/traefikGo

  All versions

• github.com/traefik/traefik/v2Go

  fixed in 2.11.43

• github.com/traefik/traefik/v3Go

  From 3.0.0-beta1 · fixed in 3.6.14; From 3.7.0-ea.1 · fixed in 3.7.0-rc.2

• github.com/traefik/traefik/v3Go

  From 3.7.0-ea.1 · fixed in 3.7.0-rc.2

• github.com/traefik/traefik/v3Go

  From 3.0.0-beta1 · fixed in 3.6.14

• github.com/traefik/traefikGo

  through 1.7.34

References 4