CVE-2026-71326

score

0.1

cvss

3.8

epss

0.3%

published

2026-08-06

kev added

—

first seen

2026-10-21

Traefik 3.6.11 to 3.6.25 and 3.7.10 contains an authentication bypass caused by deduplication of concurrent password checks using concatenated password and secret keys in BasicAuth middleware, letting attackers with valid credentials authenticate as unconfigured usernames when headerField trusts forwarded identity, exploit requires valid credentials and stored hash.