CVE-2026-88010: Traefik BasicAuth singleflight username enumeration via timing oracle

CVE-2026-88010 · Severity: medium · CVSS 4 · Published 2026-09-22

Traefik's BasicAuth middleware can leak whether a username exists on the system through timing differences when multiple login requests are sent concurrently. An attacker can send overlapping credential attempts and measure response times to determine if a given username is valid—faster responses indicate a non-existent user, while slower responses indicate the user exists. This allows attackers to enumerate valid usernames without needing correct passwords, potentially aiding account-targeting attacks.

Technologies: github.com/traefik/traefik (Go), Traefik. Vendors: Go, Traefik.

Quick answers

Is CVE-2026-88010 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88010 being exploited in the wild.
How severe is CVE-2026-88010?
Medium severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?
github.com/traefik/traefik (Go) SEMVER:introduced=0; Traefik (Go) SEMVER:introduced=3.6.11,fixed=3.7.13; Traefik v3.6.11 through v3.7.12.
Is there a fix for CVE-2026-88010?
Yes. Traefik (Go): upgrade to 3.7.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88010 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-88010?
Check whether you run github.com/traefik/traefik (Go), Traefik (Go) or Traefik at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Traefik (Go): upgrade to 3.7.13 or later
    go get Traefik@v3.7.13

Technical details

The vulnerability is a timing oracle in Traefik's BasicAuth middleware that exploits request-coalescing logic intended to deduplicate password hashes. The singleflight deduplication key was constructed from the submitted password plus the stored secret, causing all non-existent usernames to share a single key while each real username had its own key. Under concurrent load, a probe request can race an attacker-controlled leader request: if the username does not exist, the probe receives the leader's fast cached result (coalesced); if the username exists, the probe computes its own hash (slow). This reintroduces a username-enumeration side-channel despite the presence of a `notFoundSecret` dummy hash intended to equalize sequential lookup costs. The attack requires attacker-controlled concurrency and network access but no authentication. The fix changes the singleflight key derivation to use only submitted credentials (username + password), removing the existence-dependent partitioning. Affected versions: Traefik v3.6.11 through v3.7; v2 and Digest Auth are unaffected.

Affected products

  • Traefik Traefik v3.6.11 through v3.7.12

Identifiers

  • CVE-2026-88010
  • GHSA-8fcf-v89g-xpg6
  • GO-2026-6558

Timeline

  • 2026-09-22: disclosed
  • 2026-09-22: patched: Fixed in v3.7.13
  • 2026-09-22: advisory: GHSA-8fcf-v89g-xpg6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.