CVE-2026-71326Low· 3.8▾ SunlitTraefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key bui…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
— → 3.8
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
traefik >= 3.6.11, < 3.6.25traefik >= 3.7.0, < 3.7.10Upgrade past the affected range:
traefik 3.7.10Affected packages:
github.com/traefik/traefik/v3 >= 3.6.11, <= 3.6.24github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.9Patched in:
github.com/traefik/traefik/v3 3.6.25github.com/traefik/traefik/v3 3.7.10Source: https://github.com/advisories/GHSA-6765-c87h-8mrf
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-71327High· 8.1Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-71325Medium· 4.4Traefik is an open-source edge router that makes publishing services a fun and easy experience
CVE-2026-85596Critical· 9.8Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider
CVE-2026-85595Critical· 9.8Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection
CVE-2026-71324Critical· 9.1Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-88877Critical· 9.8Traefik is a HTTP reverse proxy and load balancer