6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41263

CVE-2026-41263: Traefik: BasicAuth middleware: timing side-channel vulnerability

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41263

CVE-2026-41263:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/traefik/traefik/v3	go	>= 3.7.0-ea.1, < 3.7.0-rc.2	3.7.0-rc.2
github.com/traefik/traefik/v3	go	>= 3.0.0-beta1, < 3.6.14	3.6.14
github.com/traefik/traefik/v2	go	< 2.11.43	2.11.43
github.com/traefik/traefik	go	<= 1.7.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the NewBasic function within the basic_auth.go file. The core of the issue is a logical error in how the notFoundSecret variable is initialized. This variable is crucial for preventing timing attacks during basic authentication. In the vulnerable versions, the code attempts to look up a secret from a map of users, but the key used for the lookup is derived from the map's values, not its keys. This results in notFoundSecret always being an empty string. Consequently, when an invalid username is provided, the goauth.CheckSecret function, which is supposed to perform a constant-time comparison, short-circuits because it receives an empty secret. This creates a significant and measurable difference in response time between requests with valid and invalid usernames, allowing an attacker to enumerate valid usernames. The patch, identified in commit 8c4fc89579d0410e2b312429a074ace50be3acca, corrects this by directly taking a value from the user map to use as the notFoundSecret. This ensures that a proper, non-empty secret is used in the comparison, thereby eliminating the timing discrepancy and closing the vulnerability.

Vulnerable functions

NewBasic

pkg/middlewares/auth/basic_auth.go

The `NewBasic` function in `pkg/middlewares/auth/basic_auth.go` was vulnerable to a timing side-channel attack. The variable `notFoundSecret`, intended to hold a constant-time fallback secret, was always an empty string due to a map key/value confusion. This caused the constant-time comparison to short-circuit, allowing an attacker to distinguish between existing and non-existing users by measuring the response time of the authentication process. The patch corrects this by ensuring `notFoundSecret` is assigned a valid hash, thus mitigating the timing oracle.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.