CVE-2026-88010

Name of the Vulnerable Software and Affected Versions Traefik versions 3.6.11 through 3.7.12

Description An unauthenticated timing discrepancy exists in the checkPassword() function within pkg/middlewares/auth/basic auth.go. The issue occurs because the BasicAuth singleflight key is constructed using the submitted password and stored secret. Consequently, concurrent requests for non-existent usernames coalesce on a single key, whereas requests for existing usernames trigger separate password hashes. This difference in processing time allows an attacker to determine if a specific username exists on the system. This issue does not disclose credentials or allow authentication bypass.

Recommendations Update to version 3.7.13.