Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| traefik | traefik | 3.6.11 to before 3.6.25; 3.7.0 to before 3.7.10 | 3.6.25, 3.7.10 | Patch available | CNA |
| — | github.com/traefik/traefik/v3 (Go) | 3.6.11 to before 3.6.25 | 3.6.25 | Patch available | GHSA-6765-c87h-8mrf |
| — | github.com/traefik/traefik/v3 (Go) | 3.7.0 to before 3.7.10 | 3.7.10 | Patch available | GHSA-6765-c87h-8mrf |
- traefik Vendortraefik Affected 3.6.11 to before 3.6.25; 3.7.0 to before 3.7.10 Fixed in 3.6.25, 3.7.10 Patch available CNA
- github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.6.11 to before 3.6.25 Fixed in 3.6.25 Patch available GHSA-6765-c87h-8mrf
- github.com/traefik/traefik/v3 (Go) Vendor— Affected 3.7.0 to before 3.7.10 Fixed in 3.7.10 Patch available GHSA-6765-c87h-8mrf
Remediation
- Fix · CNA traefik (traefik) Fixed in 3.6.25, 3.7.10
- Fix · GHSA-6765-c87h-8mrf github.com/traefik/traefik/v3 (Go) Fixed in 3.6.25 Advisory →
- Fix · GHSA-6765-c87h-8mrf github.com/traefik/traefik/v3 (Go) Fixed in 3.7.10 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat OpenShift Dev Spaces
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71326
- 2026-10-03 Alias added: GHSA-6765-c87h-8mrf
References
Patch 5
- https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf
- https://github.com/traefik/traefik/pull/13572
- https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350
- https://github.com/traefik/traefik/releases/tag/v3.6.25
- https://github.com/traefik/traefik/releases/tag/v3.7.10
More Traefik vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-25774 Uncontrolled Resource Consumption in Traefik CVSS 3.1HIGH 7.5
- TI-2025-40914 Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules CVSS 4.0MEDIUM 6.9
- TI-2022-07529 Authorization header displayed in the debug logs CVSS 3.1MEDIUM 6.5
- TI-2024-30459 HTTP client can remove the X-Forwarded headers in Traefik CVSS 3.1CRITICAL 9.8
- TI-2026-60261 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-71326 · CVE Program
- CVE-2026-71326 · NVD
- FIRST EPSS
- GHSA-6765-c87h-8mrf · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71326 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences