Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.

The version of Traefik installed on the remote macOS host is prior to 2.11.41 or 3.x prior to 3.6.11. It is, therefore, affected by multiple vulnerabilities:

  - mTLS bypass through the TLS SNI pre-sniffing logic related to fragmented ClientHello packets. When a TLS     ClientHello is fragmented across multiple records, Traefik's SNI extraction may fail with an EOF and return     an empty SNI. The TCP router then falls back to the default TLS configuration, which does not require client     certificates by default. This allows an attacker to bypass route-level mTLS enforcement and access services     that should require mutual TLS authentication. (CVE-2026-32305)

  - BasicAuth middleware allows username enumeration via a timing attack. When a submitted username exists, the     middleware performs a bcrypt password comparison taking significantly longer than when the username does not     exist. This timing difference is observable over the network and allows an unauthenticated attacker to     reliably distinguish valid from invalid usernames. (CVE-2026-32595)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 832a823b-25b5-11f1-b6f8-5404a68ad561 advisory.

    The traefik project releases a new version addressing multiple CVEs:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through
    3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack.
    When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When
    the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is
    observable over the network and allows an unauthenticated attacker to reliably distinguish valid from
    invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2. (CVE-2026-32595)

ID	Name	Product	Family	Severity
303797	Traefik < 2.11.41 / 3.x < 3.6.11 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
303310	FreeBSD : traefik -- Multiple vulnerabilities (832a823b-25b5-11f1-b6f8-5404a68ad561)	Nessus	FreeBSD Local Security Checks	high
439063	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-g3hg-j4jv-cwfr)	Tenable Cloud Security	SCA Checks	medium
439063	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-g3hg-j4jv-cwfr)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-32595

medium

Tenable Plugins

high

high

medium

medium