CVE-2026-71326

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.

• CWE-287

• https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350Patch
• https://github.com/traefik/traefik/pull/13572Patch
• https://github.com/traefik/traefik/releases/tag/v3.6.25Patch, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.7.10Patch, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrfPatch, Vendor Advisory

Published

Aug 6, 2026

Last Modified

Sep 16, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7132A vulnerability was found in code-projects Online Lot Reserv…5.5
• CVE-2026-71320Nuxt is an open-source web development framework for Vue.js.…8.1
• CVE-2026-71321Nuxt is an open-source web development framework for Vue.js.…7.5
• CVE-2026-71322Lemur manages TLS certificate creation. Prior to 1.9.3, Cert…4.3
• CVE-2026-71324Traefik is an open source HTTP reverse proxy and load balanc…9.1
• CVE-2026-71325Traefik is an open-source edge router that makes publishing …4.4
• CVE-2026-71327Traefik is an open source HTTP reverse proxy and load balanc…8.1
• CVE-2026-71328Heap-based buffer overflow in Visual Studio allows an unauth…8.8
• CVE-2026-71329Heap-based buffer overflow in Windows NTFS allows an unautho…6.8
• CVE-2026-7133A vulnerability was determined in code-projects Online Lot R…4.7
• CVE-2026-71330Exposure of sensitive system information to an unauthorized …7.5
• CVE-2026-71331Integer overflow or wraparound in Windows Device Health Atte…8.1