Executive brief
Traefik's BasicAuth middleware can leak whether a username exists on the system through timing differences when multiple login requests are sent concurrently. An attacker can send overlapping credential attempts and measure response times to determine if a given username is valid—faster responses indicate a non-existent user, while slower responses indicate the user exists. This allows attackers to enumerate valid usernames without needing correct passwords, potentially aiding account-targeting attacks.
Technical details
The vulnerability is a timing oracle in Traefik's BasicAuth middleware that exploits request-coalescing logic intended to deduplicate password hashes. The singleflight deduplication key was constructed from the submitted password plus the stored secret, causing all non-existent usernames to share a single key while each real username had its own key. Under concurrent load, a probe request can race an attacker-controlled leader request: if the username does not exist, the probe receives the leader's fast cached result (coalesced); if the username exists, the probe computes its own hash (slow). This reintroduces a username-enumeration side-channel despite the presence of a `notFoundSecret` dummy hash intended to equalize sequential lookup costs. The attack requires attacker-controlled concurrency and network access but no authentication. The fix changes the singleflight key derivation to use only submitted credentials (username + password), removing the existence-dependent partitioning. Affected versions: Traefik v3.6.11 through v3.7; v2 and Digest Auth are unaffected.
Affected products
- Traefik Traefik v3.6.11 through v3.7.12
Timeline
- 2026-09-22: disclosed
- 2026-09-22: patched: Fixed in v3.7.13
- 2026-09-22: advisory: GHSA-8fcf-v89g-xpg6