Vulnerability in Traefik
CVE-2026-41263
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.004 (32.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 33rd percentile — 32.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Traefik — versions 3.7.0, >= 3.0.0-beta1, < 3.6.14, < 2.11.43
Weakness classification (CWE)
References
- github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h (Patch, Vendor Advisory)
- github.com/traefik/traefik/releases/tag/v2.11.43 (Product, Release Notes)
- github.com/traefik/traefik/releases/tag/v3.6.14 (Product, Release Notes)
- github.com/traefik/traefik/releases/tag/v3.7.0-rc.2 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-41263?
- CVE-2026-41263 is a low-severity vulnerability in Traefik, classified under CWE-208. CVSS score: 3.7/10. Published 2026-04-30.
- How severe is CVE-2026-41263?
- Low severity. CVSS v3 base score is 3.7 out of 10.