CVE-2026-88010: Traefik Username Enumeration Vulnerability

CVE-2026-88010 Overview

CVE-2026-88010 is a timing side-channel vulnerability in Traefik, an open source HTTP reverse proxy and load balancer. The flaw affects the checkPassword function in pkg/middlewares/auth/basic_auth.go across versions 3.6.11 through 3.7.12. Traefik constructs the BasicAuth singleflight key from the submitted password and stored secret, causing concurrent requests for absent usernames to coalesce on one key while configured usernames perform separate password hashes. This timing discrepancy allows an unauthenticated attacker to determine whether a username exists. The issue is classified as an observable discrepancy weakness [CWE-208] and is fixed in version 3.7.13.

Critical Impact
Remote unauthenticated attackers can enumerate valid usernames configured for BasicAuth by measuring response timing differences from concurrent requests, aiding follow-on credential attacks.

Affected Products

Traefik versions 3.6.11 through 3.7.12 (BasicAuth middleware)
Traefik v2 is not affected
Digest authentication is not affected

Discovery Timeline

2026-09-22 - CVE-2026-88010 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88010

Vulnerability Analysis

The vulnerability resides in the BasicAuth middleware, specifically in how Traefik deduplicates concurrent password verification requests. The singleflight package coalesces in-flight duplicate function calls that share the same key, avoiding redundant expensive hashing operations. In the affected code, Traefik builds the deduplication key from the submitted password and the stored secret rather than the username.

When many concurrent requests target a nonexistent username, they all resolve to the same secret value and collapse into a single hash operation. Requests for configured usernames map to distinct secrets and perform independent hashes. An attacker measuring response timing under concurrent load can distinguish these two cases and confirm which usernames are provisioned.

The advisory clarifies scope: sequential checks remain cost-equalized, and the flaw does not disclose credentials or bypass authentication.

Root Cause

The root cause is an improper deduplication key construction. The original key combined the password length, password, and stored secret, so requests for absent users produced identical keys and a single hash. Requests for valid users produced unique keys tied to their stored secrets and incurred separate hashing costs. This construction leaked username existence through concurrent-request timing.

Attack Vector

An unauthenticated remote attacker sends bursts of concurrent BasicAuth requests using candidate usernames with arbitrary passwords. By comparing aggregate response latency for nonexistent versus configured usernames, the attacker infers which usernames exist. No credentials, prior access, or user interaction are required.

 func (b *basicAuth) checkPassword(user, password string) bool {
 	secret := b.auth.Secrets(user, b.auth.Realm)
 
-	// Prefix the password length so the key unambiguously encodes the
-	// (password, secret) pair and distinct pairs cannot collide.
-	key := strconv.Itoa(len(password)) + ":" + password + secret
-	match, _, _ := b.singleflightGroup.Do(key, func() (any, error) {
+	match, _, _ := b.singleflightGroup.Do(singleflightKey(user, password), func() (any, error) {
 		if secret == "" {
 			_ = b.checkSecret(password, b.notFoundSecret)
 			return false, nil

Source: Traefik GitHub Commit ddc1bf4. The patch changes the singleflight key to include the username, ensuring concurrent requests for absent usernames no longer coalesce into a single hash operation and eliminating the timing discrepancy.

Detection Methods for CVE-2026-88010

Indicators of Compromise

Bursts of concurrent HTTP requests with Authorization: Basic headers targeting the same endpoint from a single source IP or narrow IP range.
High volumes of failed BasicAuth attempts iterating through candidate usernames with identical or repeated passwords.
Access-log patterns showing sequential enumeration of usernames alphabetically or from common wordlists against Traefik-fronted services.

Detection Strategies

Monitor Traefik access logs for repeated 401 Unauthorized responses on BasicAuth-protected routes originating from the same client.
Alert on request rate anomalies where concurrent BasicAuth attempts exceed baseline thresholds within short time windows.
Correlate response-time distributions across authentication endpoints to identify probing behavior consistent with timing analysis.

Monitoring Recommendations

Enable verbose access logging on Traefik middleware endpoints and forward logs to a centralized analytics platform for correlation.
Track authentication failure rates per source IP and per username to surface enumeration campaigns.
Deploy rate limiting and anomaly detection at the reverse proxy layer to identify high-concurrency probing.

How to Mitigate CVE-2026-88010

Immediate Actions Required

Upgrade Traefik to version 3.7.13 or later, which corrects the singleflight key construction in checkPassword.
Inventory all Traefik deployments and identify instances running versions 3.6.11 through 3.7.12 with BasicAuth middleware configured.
Review authentication logs for prior enumeration attempts and rotate any usernames considered sensitive.

Patch Information

The fix is available in Traefik v3.7.13. The corresponding change is documented in Pull Request #13816 and GitHub Security Advisory GHSA-8fcf-v89g-xpg6. The patched singleflightKey(user, password) function ensures concurrent requests for absent usernames do not coalesce into a single hash.

Workarounds

Switch affected routes to Digest authentication, which is not impacted by this vulnerability.
Downgrade to Traefik v2 for authentication-critical routes if immediate upgrade to 3.7.13 is not feasible.
Place a rate-limiting middleware or WAF in front of BasicAuth-protected endpoints to blunt concurrent probing attempts.

bash

# Upgrade Traefik container image to the patched release
docker pull traefik:v3.7.13
docker stop traefik && docker rm traefik
docker run -d --name traefik traefik:v3.7.13

# Verify running version
traefik version