CVE-2026-32595

score

<0.1

cvss

3.7

epss

0.4%

published

2026-03-20

kev added

—

first seen

2026-10-21

Traefik <= 2.11.40, 3.0.0-beta1 to 3.6.11, and 3.7.0-ea.1 contain a username enumeration vulnerability caused by timing differences in BasicAuth middleware bcrypt password comparison, letting unauthenticated attackers distinguish valid usernames via network timing attack.