{"id":"CVE-2026-41263","aliases":["GHSA-6x2q-h3cr-8j2h","GO-2026-5195"],"url":"https://o3.security/vulnerability/CVE-2026-41263","summary":"Traefik: BasicAuth middleware: timing side-channel vulnerability","details":"## Summary\n\nThere is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences.\n\nThe variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.43\n- https://github.com/traefik/traefik/releases/tag/v3.6.14\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2\n\n## For more information\n\nIf there are any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n# BasicAuth Timing Regression: CVE-2026-32595 Fix Is a No-Op Due to Map Key/Value Confusion\n\n## TL;DR\n\nThe patch for CVE-2026-32595 is a no-op. Line 49 of `basic_auth.go` has a\nmap key/value confusion that makes `notFoundSecret` always `\"\"`. The\n\"constant time\" fallback calls `goauth.CheckSecret(password, \"\")`, which\nfast-fails in ~1us instead of running bcrypt (~60ms).\n\n## Evidence (HEAD `786f7192e`, 2026-04-09)\n\nBlack-box PoC against live traefik binary on port 28080:\n\n| bucket                       | n   | median   | min      |\n|------------------------------|-----|----------|----------|\n| existing user (wrong pw)     | 240 | 62.85 ms | 57.54 ms |\n| nonexistent user (wrong pw)  | 400 |  0.48 ms |  0.35 ms |\n\nMedian ratio: **130.4x**. Classification: **8/8 correct**.\n\nGo in-tree test: `goauth.CheckSecret` direct ratio **12,746x**.\n\n## Root cause (4-step trace)\n\n1. `basic_auth.go:49`: `users[slices.Collect(maps.Values(users))[0]]` -- looks\n   up a hash as a username key, returns `\"\"`.\n2. `basic_auth.go:119-120`: calls `goauth.CheckSecret(password, \"\")`.\n3. `go-http-auth/basic.go:87`: empty string matches no prefix, falls to default\n   `compareMD5HashAndPassword`.\n4. `basic.go:107-109`: `bytes.SplitN(\"\", \"$\", 4)` returns length 1, function\n   returns instantly.\n\n## Files\n\n- `poc/exploit.py` -- black-box Python timing oracle\n- `poc/basic_auth_timing_regression_test.go` -- Go in-tree test\n- `poc/traefik.yml` + `poc/dynamic.yml` -- traefik config\n- `poc/live_http_poc_output_head.txt` -- verbatim PoC output on HEAD\n\n\nKoda Reef\n\n</details>\n\n---","published":"2026-04-30T20:39:49.658Z","modified":"2026-08-12T03:51:19.701618396Z","cvss":null,"epss":{"score":0.00369,"percentile":0.29561,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","fixedVersion":"3.7.0-rc.2"},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","fixedVersion":"3.6.14"},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","fixedVersion":"2.11.43"},{"ecosystem":"Go","name":"github.com/traefik/traefik","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v2.11.43"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v3.6.14"},{"type":"WEB","url":"https://github.com/traefik/traefik/releases/tag/v3.7.0-rc.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41263.json"},{"type":"ADVISORY","url":"https://github.com/traefik/traefik/security/advisories/GHSA-6x2q-h3cr-8j2h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41263"},{"type":"PACKAGE","url":"https://github.com/traefik/traefik"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:19.701618396Z"}}