Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-20 | 1 | General1 |
| 2026-03-22 | 1 | Disclosure1 |
| 2026-04-24 | 1 | General1 |
🟠 Traefik, Timing Side-Channel Username Enumeration, #CVE-2026-32595 (Medium) https://dailycve.com/traefik-timing-side-channel-username-enumeration-cve-2026-32595-medium/
Post summary
The link announces a medium‑severity timing side‑channel username enumeration vulnerability in Traefik (CVE‑2026‑32595), but offers no PoC, exploit code, active‑exploitation claim, or patch information.
CVE-2026-32595 Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows us… https://www.cve.org/CVERecord?id=CVE-2026-32595
Post summary
The message announces a new CVE (CVE‑2026‑32595) for Traefik, listing affected versions but providing no additional details, PoC, or evidence of exploitation.
CVE-2026-32595 Traefik BasicAuth Middleware Timing Attack Enables Username Enumeration https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32595
Post summary
The text describes a timing‑based username enumeration vulnerability in Traefik’s BasicAuth middleware, but offers no details on PoC, exploit code, active exploitation, or remediation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traefik | traefik | - | - | - |
| App | traefik | traefik | 3.7.0 | - | - |