CVE-2026-71326

Received Received - Intake

Authentication Bypass in Traefik Reverse Proxy

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: GitHub, Inc.

Description

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-71326

Affected Vendors & Products

Vendor	Product	Version / Range
traefik	traefik	From 3.6.11 (inc) to 3.6.25 (inc)
traefik	traefik	3.7.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

Traefik's BasicAuth middleware from versions 3.6.11 to 3.6.25 and 3.7.10 has a flaw where concurrent password checks are deduplicated using a singleflight key made from concatenating password and secret without a delimiter. This allows an attacker with a valid credential and stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity.

Impact Analysis

An attacker could exploit this to gain unauthorized access to systems protected by Traefik's BasicAuth middleware, potentially bypassing authentication for unconfigured usernames if headerField trusts forwarded identity. The impact is limited to scenarios where an attacker already has valid credentials and the stored hash.

Compliance Impact

This vulnerability could lead to unauthorized access, potentially violating data protection requirements under GDPR or HIPAA. Organizations using affected Traefik versions may face compliance risks if the flaw enables data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Upgrade Traefik to version 3.6.25 or later for the 3.6.x branch, or to version 3.7.10 or later for the 3.7.x branch to address the BasicAuth middleware issue.

Hi! I’m here to help you understand CVE-2026-71326. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70