Executive brief
Traefik is a popular open-source edge router and load balancer used to manage web traffic. A flaw in its basic authentication system allows a user who already has valid credentials and access to the system's internal configuration to impersonate other users. This could allow an attacker to perform actions or access data belonging to a different account, potentially leading to unauthorized administrative changes or data exposure.
Technical details
A vulnerability exists in Traefik's BasicAuth middleware where concurrent password verifications are deduplicated using a 'singleflight' group. The deduplication key is formed by the delimiter-free concatenation of the submitted password and the stored secret (hash). An attacker who knows a valid password 'P' and its corresponding hash 'H' can submit a request for an unconfigured username using 'P+H' as the password. Because the secret for an unconfigured user is an empty string, the resulting key ('P+H' + '') matches the key of a concurrent valid request ('P' + 'H'). If the valid request starts the calculation, the attacker's request receives the successful result and is forwarded to the backend with the attacker-specified username. This allows identity spoofing and privilege escalation, especially when Traefik is configured to forward the authenticated username via a header field. Patches are available in versions 3.6.25 and 3.7.10.
Affected products
- Traefik Labs Traefik >= 3.6.11, <= 3.6.24
- Traefik Labs Traefik >= 3.7.0, <= 3.7.9
Timeline
- 2026-08-03: disclosed: Initial disclosure on GitHub Advisories
- 2026-08-06: advisory: Updated advisory published