CVE-2026-71326
Low
No strong exploitation signal.
CVSS base
3.8
LOW
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS — probability of exploitation (30 days)
0.3%
17.6th percentile
CISA KEV
Not listed
Weakness / dates
CWE-287
Published 2026-08-06 · modified 2026-09-16
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | H | High |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | L | Low |
| Integrity | L | Low |
| Availability | N | None |
Timeline
- 2026-08-06 — Published (NVD)
- 2026-09-16 — Last modified (NVD)
Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
Affected
References
- https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350
- https://github.com/traefik/traefik/pull/13572
- https://github.com/traefik/traefik/releases/tag/v3.6.25
- https://github.com/traefik/traefik/releases/tag/v3.7.10
- https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf