CVE-2026-41263

score

<0.1

cvss

3.7

epss

0.4%

published

2026-04-30

kev added

—

first seen

2026-10-21

Traefik < 2.11.43, 3.6.14, and 3.7.0-rc.2 contains a timing side-channel vulnerability in BasicAuth middleware caused by an empty fallback secret leading to short-circuited constant-time comparison, letting attackers enumerate valid usernames via response-time differences, exploit requires attacker to measure authentication response times.