FIND-20260410-012 · 2026-04-10 · Innovation Veille

CVE-2026-32595 — Traefik BasicAuth Timing Attack Allows Username Enumeration (CVSS 6.3, Medium)

cve MEDIUM
Traefik's BasicAuth middleware creates a timing side-channel that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network. CVSS 4.0 score 6.3 (Medium). Patched in Traefik 2.11.41, 3.6.11, and 3.7.0-ea.2. ODS Traefik 3.6.13 is patched.

Source

https://nvd.nist.gov/vuln/detail/CVE-2026-32595

ODS Impact

API Gateway (Traefik 3.6.13) — ODS uses BasicAuth middleware in some service configurations. If admin or internal endpoints use BasicAuth, username enumeration is possible on unpatched versions. ODS 3.6.13 is patched — no immediate action required but review if BasicAuth is used on exposed endpoints.

Security Review

License: MIT | Maintenance: ACTIVE | Risk: LOW | Recommendation: SAFE_TO_USE

Tags

traefik cve basicauth timing-attack security