{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0-ea.1"
            },
            {
              "fixed": "3.7.0-rc.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0-beta1"
            },
            {
              "fixed": "3.6.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.43"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.7.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-41263"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-24T20:36:41Z",
    "nvd_published_at": "2026-04-30T21:16:33Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a timing side-channel vulnerability in Traefik\u0027s BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.\n\nThe variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.43\n- https://github.com/traefik/traefik/releases/tag/v3.6.14\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n# BasicAuth Timing Regression: CVE-2026-32595 Fix Is a No-Op Due to Map Key/Value Confusion\n\n## TL;DR\n\nThe patch for CVE-2026-32595 is a no-op. Line 49 of `basic_auth.go` has a\nmap key/value confusion that makes `notFoundSecret` always `\"\"`. The\n\"constant time\" fallback calls `goauth.CheckSecret(password, \"\")`, which\nfast-fails in ~1us instead of running bcrypt (~60ms).\n\n## Evidence (HEAD `786f7192e`, 2026-04-09)\n\nBlack-box PoC against live traefik binary on port 28080:\n\n| bucket                       | n   | median   | min      |\n|------------------------------|-----|----------|----------|\n| existing user (wrong pw)     | 240 | 62.85 ms | 57.54 ms |\n| nonexistent user (wrong pw)  | 400 |  0.48 ms |  0.35 ms |\n\nMedian ratio: **130.4x**. Classification: **8/8 correct**.\n\nGo in-tree test: `goauth.CheckSecret` direct ratio **12,746x**.\n\n## Root cause (4-step trace)\n\n1. `basic_auth.go:49`: `users[slices.Collect(maps.Values(users))[0]]` -- looks\n   up a hash as a username key, returns `\"\"`.\n2. `basic_auth.go:119-120`: calls `goauth.CheckSecret(password, \"\")`.\n3. `go-http-auth/basic.go:87`: empty string matches no prefix, falls to default\n   `compareMD5HashAndPassword`.\n4. `basic.go:107-109`: `bytes.SplitN(\"\", \"$\", 4)` returns length 1, function\n   returns instantly.\n\n## Files\n\n- `poc/exploit.py` -- black-box Python timing oracle\n- `poc/basic_auth_timing_regression_test.go` -- Go in-tree test\n- `poc/traefik.yml` + `poc/dynamic.yml` -- traefik config\n- `poc/live_http_poc_output_head.txt` -- verbatim PoC output on HEAD\n\n\nKoda Reef\n\n\u003c/details\u003e\n\n---",
  "id": "GHSA-6x2q-h3cr-8j2h",
  "modified": "2026-05-06T21:24:51Z",
  "published": "2026-04-24T20:36:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41263"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.43"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.14"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik: A timing side-channel vulnerability allows for valid username enumeration via BasicAuth middleware"
}