CVE-2026-88010
Received Received - Intake

Timing Side Channel in Traefik Basic Authentication

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing discrepancy that reveals whether a username exists. Sequential checks remain cost-equalized, Traefik v2 and Digest authentication are not affected, and the issue does not disclose credentials or bypass authentication. This issue is fixed in version 3.7.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-88010
EUVD
EUVD-2026-84532

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
traefik traefik From 3.6.11 (inc) to 3.7.13 (exc)
traefik traefik to 3.7.13 (exc)
traefik traefik 3.7.13
traefik traefik From 3.6.11 (inc) to 3.7.13 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88010 is a timing-based username enumeration vulnerability in Traefik's BasicAuth middleware. It affects versions 3.6.11 to 3.7.12 where concurrent authentication requests for non-existent usernames share a deduplication key based on the password and stored secret. This creates timing differences revealing whether a username exists without bypassing authentication or disclosing credentials.

Detection Guidance

Detecting this vulnerability requires checking Traefik version and monitoring authentication timing discrepancies. First, verify Traefik version with: traefik version. If version is between 3.6.11 and 3.7.12, the system is vulnerable. Next, monitor authentication response times for concurrent requests to identify timing differences that may indicate username enumeration.

Impact Analysis

Attackers could exploit timing differences to determine valid usernames in your system. This enables targeted phishing attacks or reconnaissance of user accounts. The vulnerability does not allow credential theft or direct authentication bypass but compromises user privacy by exposing account existence.

Compliance Impact

This vulnerability may violate privacy requirements under GDPR (data minimization, integrity) and HIPAA (access controls, audit safeguards) by enabling unauthorized username enumeration. Organizations must mitigate it to maintain compliance with user data protection standards.

Mitigation Strategies

Immediately upgrade Traefik to version 3.7.13 or later. This can be done by downloading the latest release from the official Traefik website or using package managers. After upgrading, restart Traefik services to apply the fix. No additional configuration changes are required as the fix is included in the updated version.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88010. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart