PT-2026-26602 · Traefik · Traefik

F1Vet · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-32595

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.40 and below Traefik versions 3.0.0-beta1 through 3.6.11 Traefik version 3.7.0-ea.1

Description Traefik’s BasicAuth middleware has a flaw that allows an unauthenticated attacker to enumerate valid usernames through a timing attack. When a valid username is submitted, the middleware performs a bcrypt password comparison, taking approximately 166 milliseconds. If the username is invalid, the response is returned immediately in about 0.6 milliseconds. This approximately 298-times timing difference is observable over the network, enabling an attacker to reliably identify valid usernames.

Recommendations Update to Traefik version 2.11.41 or later. Update to Traefik version 3.6.11 or later. Update to Traefik version 3.7.0-ea.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-208

Related Identifiers

CVE-2026-32595

GHSA-G3HG-J4JV-CWFR

GO-2026-4792

OPENSUSE-SU-2026:10444-1

OPENSUSE-SU-2026:10445-1

SUSE-SU-2026:1135-1

Affected Products

Traefik

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32595.json · Exploit
• https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32595 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g3hg-j4jv-cwfr · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10444-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4792 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32595 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10445-1 · Vendor Advisory
• https://github.com/traefik/traefik · Note
• https://github.com/traefik/traefik/releases/tag/v3.6.11 · Note
• https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2 · Note
• https://github.com/traefik/traefik/releases/tag/v2.11.41 · Note
• https://suse.com/security/cve/CVE-2026-33622 · Note
• https://suse.com/security/cve/CVE-2026-33223 · Note