CVE-2026-32595
Fixed in a distro release EPSS <1%CVSS 6.3
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
Products: traefik
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/traefik/traefik | no fix |
| Go | github.com/traefik/traefik/v2 | 2.11.41 |
| Go | github.com/traefik/traefik/v3 | 3.6.11 |
| Go | github.com/traefik/traefik/v3 | 3.7.0-ea.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | traefik-3.5 | no fix |
| Chainguard | traefik-3.5 | 3.5.6-r6 |
| Chainguard | traefik-fips-3.5 | no fix |
| Wolfi | traefik-3.5 | 3.5.6-r6 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260326T203309-150000.1.155.2 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | traefik | 3.6.12-1.1 |
| openSUSE Tumbleweed | traefik2 | 2.11.42-1.1 |