CVE-2026-71326

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71326
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71326.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71326
Aliases
Downstream
Published
2026-08-06T16:34:23.931Z
Modified
2026-08-18T15:10:47.240700768Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing
Details

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71326.json",
    "cwe_ids": [
        "CWE-287"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/traefik/traefik

Affected ranges

Type
GIT
Repo
https://github.com/traefik/traefik
Events
Introduced
33219a0af86c41a8db81d37c444f65172bfb3e35
Introduced
04aa6bb4f9776f2ba87e5cd181d250e3610e6419
Fixed
4b18b24b0b002dcc80e0640c6088a87d813de29a
Fixed
2a2349356c01b1b1f7ecddb0c17b30c97f5241e7
Fixed
b5ace8eb5d6779980567f5e75efd2d9e08b7e350
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.6.11"
        },
        {
            "fixed": "3.6.25"
        },
        {
            "introduced": "3.7.0"
        },
        {
            "fixed": "3.7.10"
        }
    ]
}

Affected versions

v3.*
v3.6.11
v3.6.12
v3.6.13
v3.6.14
v3.6.15
v3.6.16
v3.6.17
v3.6.18
v3.6.19
v3.6.20
v3.6.21
v3.6.22
v3.6.23
v3.6.24
v3.7.0
v3.7.1
v3.7.2
v3.7.3
v3.7.4
v3.7.5
v3.7.6
v3.7.7
v3.7.8
v3.7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71326.json"