Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-30 | 2 | Disclosure2 |
| 2026-05-01 | 1 | Disclosure1 |
CVE-2026-41263 Timing Side-Channel Vulnerability in Traefik BasicAuth Middleware Prior to 2.11.43 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41263
Post summary
A timing side‑channel vulnerability has been disclosed affecting Traefik BasicAuth Middleware before version 2.11.43, with reference to a vulnerability detail page.
🚨*CVE* CVE-2026-41263 Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's Basic… https://www.cve.org/CVERecord?id=CVE-2026-41263 ----- Traducción: CVE-2026-41263 Tra… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑41263, a timing side‑channel flaw in older Traefik releases, without providing a PoC, exploit code, active exploitation evidence, or patch details.
CVE-2026-41263 Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's Basic… https://www.cve.org/CVERecord?id=CVE-2026-41263
Post summary
The message announces CVE‑2026‑41263, a timing side‑channel flaw in earlier Traefik releases, and points to the CVE record for more detail.
5 of 5 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | traefik | traefik | - | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |
| App | traefik | traefik | 3.7.0 | - | - |