CVE-2026-71326

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.11 through 3.6.24 Traefik versions 3.7.0 through 3.7.9

Description Traefik's BasicAuth middleware contains an issue where concurrent password checks are deduplicated using a singleflight key created by concatenating the password and the secret without a delimiter. An attacker who possesses a valid credential and the corresponding stored password hash can authenticate as an unconfigured username by providing a password consisting of the concatenation of the valid password and the hash. Since the unconfigured user has an empty secret, the resulting key collides with that of the valid user, allowing the attacker to receive a successful authentication result.

This can lead to privilege escalation if the headerField is configured to trust the forwarded identity, as the backend will receive the attacker-selected username. Exploitation requires network access to a protected route, a valid low-privilege credential, and the stored password hash, which may be accessible via the API endpoint /api/http/middlewares/{id}, Kubernetes Secrets, or Docker sockets.

Recommendations Update Traefik to version 3.6.25. Update Traefik to version 3.7.10. As a temporary mitigation, avoid using the headerField option in BasicAuth middleware to prevent the forwarding of untrusted identities to the backend.