CVE-2026-41263

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.43 Traefik versions prior to 3.6.14 Traefik versions prior to 3.7.0-rc.2

Description A timing side-channel issue exists in the BasicAuth middleware. A variable meant to provide a constant-time fallback secret consistently resolves to an empty string, which causes the constant-time comparison to short-circuit quickly instead of completing a full bcrypt evaluation. This creates a timing oracle, allowing an attacker to enumerate valid usernames by measuring differences in authentication response times.

Recommendations Update to version 2.11.43 Update to version 3.6.14 Update to version 3.7.0-rc.2