---
id: CVE-2026-71326
title: Traefik is an open source HTTP reverse proxy and load balancer
summary: >-
  Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11
  until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in
  pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks
  with a singleflight key bui…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-287
  - CWE-836
vendor: traefik
product: traefik
affected:
  - 'traefik >= 3.6.11, < 3.6.25'
  - 'traefik >= 3.7.0, < 3.7.10'
patched:
  - traefik 3.7.10
published: '2026-08-06'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T20:44:44.453'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71326'
references:
  - url: >-
      https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/pull/13572'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.6.25'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.7.10'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-6765-c87h-8mrf'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71326.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-71326'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2512295'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-71326'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71326'
tags:
  - nvd
  - ghsa
  - go
  - csaf
  - vex
  - red-hat
epss: 0.00337
epssPercentile: 0.24362
aliases:
  - GHSA-6765-c87h-8mrf
ecosystem: go
ingestedAt: '2026-08-06T17:00:12.867Z'
---

## Overview

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.

## Affected

- `traefik >= 3.6.11, < 3.6.25`
- `traefik >= 3.7.0, < 3.7.10`

## Remediation

Upgrade past the affected range:

- `traefik 3.7.10`

## Package advisory (CVE-2026-71326)

Affected packages:

- `github.com/traefik/traefik/v3 >= 3.6.11, <= 3.6.24`
- `github.com/traefik/traefik/v3 >= 3.7.0, <= 3.7.9`

Patched in:

- `github.com/traefik/traefik/v3 3.6.25`
- `github.com/traefik/traefik/v3 3.7.10`

Source: https://github.com/advisories/GHSA-6765-c87h-8mrf

## Vendor advisories

- **Red Hat VEX** · Low · updated 2026-09-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-71326.json)