---
id: CVE-2026-88010
title: Traefik is an open source HTTP reverse proxy and load balancer
summary: >-
  Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11
  until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs
  the BasicAuth singleflight key from the submitted password and stored secret.
  Concur…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-208
vendor: traefik
product: traefik
affected:
  - 'traefik >= 3.6.11, < 3.7.13'
patched:
  - Traefik 3.7.13
published: '2026-09-22'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:22:19.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88010'
references:
  - url: >-
      https://github.com/traefik/traefik/commit/ddc1bf4660b85fd61fafdd821eb8216fb1a0b130
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/pull/13816'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/releases/tag/v3.7.13'
    label: security-advisories@github.com
  - url: 'https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88010'
  - url: 'https://github.com/advisories/GHSA-8fcf-v89g-xpg6'
  - url: 'https://github.com/traefik/traefik'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00691
epssPercentile: 0.50718
aliases:
  - GHSA-8fcf-v89g-xpg6
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T15:59:02.259376Z'
cvssSource: cna
ingestedAt: '2026-09-22T16:06:00.469Z'
---

## Overview

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basic_auth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing discrepancy that reveals whether a username exists. Sequential checks remain cost-equalized, Traefik v2 and Digest authentication are not affected, and the issue does not disclose credentials or bypass authentication. This issue is fixed in version 3.7.13.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-88010)

Affected packages:

- `Traefik >= 3.6.11, <= 3.7.12`

Patched in:

- `Traefik 3.7.13`

Source: https://github.com/advisories/GHSA-8fcf-v89g-xpg6