Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2,
    there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to
    enumerate valid usernames through response-time differences. The variable intended to hold a constant-time
    fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit
    in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle
    and makes it possible to distinguish existing users from non-existing ones by measuring authentication
    response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. (CVE-2026-41263)

The version of Traefik installed on the remote macOS host is prior to 2.11.43 or 3.x prior to 3.6.14. It is, therefore, affected by multiple vulnerabilities:

  - An authentication bypass via StripPrefixRegex and ForwardAuth dot-segment normalization. When StripPrefixRegex     processes URLs with percent-encoded characters, it miscalculates byte offsets, producing a dot-segment path that     authentication middleware fails to match against protection rules. (CVE-2026-40912)

  - An authentication bypass via unsanitized underscore-variant forwarded headers. Traefik's forwarded-header     sanitization logic targets only canonical header names and does not strip alias variants that use underscores     instead of dashes, allowing attackers to inject forged trust context to bypass ForwardAuth. (CVE-2026-39858)

  - An authentication bypass in ForwardAuth when trustForwardHeader is set to false behind a trusted proxy. The     X-Forwarded-Prefix header remains unstripped in authentication subrequests, allowing external attackers to     spoof the header and bypass access controls on protected routes. (CVE-2026-35051)

  - A timing side-channel in BasicAuth that allows username enumeration via bcrypt short-circuit. Due to a map     key/value confusion bug, a fallback security mechanism fails to function properly, enabling attackers to     enumerate valid usernames by analyzing response-time differences. (CVE-2026-41263)

  - A Kubernetes CRD cross-namespace isolation bypass via Chain middleware references. When     allowCrossNamespace is set to false, Traefik fails to apply the same restriction to middleware references     nested inside a Chain middleware, allowing actors to access middleware from other namespaces. (CVE-2026-41174)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
441337	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6x2q-h3cr-8j2h)	Tenable Cloud Security	SCA Checks	Local	medium
441337	SCA: security update for github.com/traefik/traefik/v2, github.com/traefik/traefik/v3 (GHSA-6x2q-h3cr-8j2h)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
311474	Traefik < 2.11.43 / 3.x < 3.6.14 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-41263

medium

Tenable Plugins

medium

medium

high