CVE-2026-71326

Executive Summary

CVE-2026-71326 is an authentication bypass vulnerability in Traefik's BasicAuth middleware affecting versions 3.6.11 through 3.6.24 and 3.7.0 through 3.7.9. The flaw resides in pkg/middlewares/auth/basic_auth.go, where concurrent password verification requests are deduplicated using a singleflight key constructed from the un-delimited concatenation of password and secret — enabling an attacker with valid credentials and knowledge of the stored hash to authenticate as an arbitrary unconfigured username when headerField forwards the identity. Successful exploitation grants unauthorized access to protected resources, potentially leading to lateral movement, data exfiltration, or complete compromise of services behind the proxy.

Technical Analysis

The vulnerability is rooted in Traefik's implementation of the BasicAuth middleware, specifically in the pkg/middlewares/auth/basic_auth.go module. The middleware authenticates incoming HTTP requests by validating the provided username and password against a set of stored credentials (typically configured via usersFile or users array in the Traefik configuration).

The core issue lies in the middleware's use of the singleflight pattern to deduplicate concurrent password checks. When multiple requests arrive simultaneously with the same password, Traefik attempts to avoid redundant bcrypt/Argon2 hash verifications by coalescing them into a single operation. The singleflight key is constructed by concatenating the password and the stored secret without any delimiter — for example, password + secret.

This becomes exploitable in the following manner:

1. An attacker who possesses valid credentials (username: attacker, password: knownpass) and knows the stored hash for another legitimate user (e.g., admin) can craft a malicious request.
2. The attacker sends a request with a username that is not configured in the middleware (e.g., attackeradmin), but with the password of the configured user (knownpass).
3. Because the singleflight key is knownpass + <stored_hash> regardless of the username, Traefik's middleware deduplicates this check with the legitimate concurrent check for admin.
4. The result of the deduplicated check is reused for the attacker's request, and since headerField trusts the forwarded identity, the attacker is authenticated as the unconfigured username, bypassing the actual credential validation for that specific username.

The root cause is a classic concurrency key collision driven by insufficient input separation (no delimiter in the concatenation). When headerField is enabled, the middleware trusts the X-Forwarded-User header (or equivalent) to determine the authenticated identity, and the singleflight cache confuses the validation result across different usernames.

The attack surface is the HTTP listener where BasicAuth middleware is applied, which in typical deployments is any publicly exposed service protected by basic authentication. The vulnerability requires:

• BasicAuth middleware enabled with a usersFile or users list containing at least one credential.
• headerField option set to a non-empty value (e.g., X-Forwarded-User).
• The attacker must already have valid credentials (one username/password pair) and know the bcrypt hash of the target user (obtainable via file read, config exposure, or other means).

The technical exploitation hinges on the timing window. The attacker must race their request concurrently with a legitimate authentication request for the target username. In practice, this can be automated with a flood of requests to trigger the singleflight caching mechanism reliably.

Exploitation Scenarios

Step 1: Reconnaissance

An attacker first identifies a Traefik instance running a vulnerable version (3.6.11–3.6.24 or 3.7.0–3.7.9). This is done via:

• Shodan queries: http.title:"Traefik" or fingerprinting the Server: Traefik header.
• Banner grabbing on port 80/443.
• Checking the Traefik version via error pages or exposed dashboard endpoints (/api or /dashboard).

The attacker probes the target to confirm BasicAuth is enabled by sending an unauthenticated request and observing a 401 Unauthorized response.

Step 2: Credential Harvesting

The attacker requires:

1. At least one valid username/password pair — obtainable through phishing, credential stuffing, default credential testing, or previous compromise.
2. The stored bcrypt hash of the target user (e.g., admin). This could be obtained via:
   • Reading the usersFile if accessible via path traversal or misconfiguration.
   • Extracting from backup files exposed on the server.
   • Leveraging a secondary vulnerability (e.g., local file inclusion) to read configuration files.

For this scenario, assume the attacker has attacker:knownpass123 as valid credentials and knows the bcrypt hash for admin is $2a$10$7EqJtq98hPqEX7fNZaFWoOhi6t9XqY9O4nC8mVHrZFn6kOM0hY8uS (illustrative hash).

Step 3: Weaponization — Crafting the Racer Request

The attacker crafts an HTTP request with:

• Authorization: Basic base64(attackeradmin:knownpass123) — where attackeradmin is an unconfigured username.
• X-Forwarded-User: attackeradmin header (if headerField is set to X-Forwarded-User).

Simultaneously, a legitimate request for admin:knownpass123 is triggered (either by the attacker automating a valid login attempt or by waiting for a legitimate user to authenticate). The malicious request is timed to arrive in the same time window as the legitimate one.

Step 4: Execution — Triggering the Singleflight Collision

The attacker floods the endpoint with thousands of concurrent requests:

• Request A (legitimate): GET /protected HTTP/1.1 with Authorization: Basic base64(admin:knownpass123)
• Request B (malicious): GET /protected HTTP/1.1 with Authorization: Basic base64(attackeradmin:knownpass123)

Because the singleflight key is knownpass123 + $2a$10$7EqJtq98hPqEX7fNZaFWoOhi6t9XqY9O4nC8mVHrZFn6kOM0hY8uS for both requests (the key does not include the username), the middleware coalesces the password verification. When the legitimate check for admin succeeds, the result is reused for attackeradmin's request.

The middleware then reads the X-Forwarded-User header (via headerField) and accepts the identity, granting the attacker access to the protected resource as if they were the legitimate user.

Step 5: Post-Exploitation

Once authenticated, the attacker:

• Accesses sensitive endpoints (e.g., /admin, /api, internal microservices).
• Performs lateral movement by using the hijacked identity to call privileged APIs.
• Exfiltrates data from backend services or modifies application state.
• If the proxy fronts a Kubernetes cluster (common for Traefik), the attacker may interact with service mesh APIs, potentially compromising the entire cluster.

The attack is stealthy because the singleflight mechanism is transparent; no error logs are generated, and the attacker's requests appear as successful authentication events.

Impact Assessment

Vulnerability Class: CWE-287 Improper Authentication.

CVSS Analysis: While this CVE lacks an official CVSS score, the vector derived from the vulnerability characteristics is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. This reflects:

• Attack Vector: Network — exploitable remotely.
• Attack Complexity: Low — no special conditions beyond a timing race.
• Privileges Required: Low — attacker needs one valid credential + the hash.
• User Interaction: None — no victim action required.
• Scope: Unchanged — the compromise is confined to the proxy/application.
• Confidentiality: High — complete access to protected resources.
• Integrity: High — ability to modify data or perform privileged actions.
• Availability: None — the vulnerability does not directly cause denial-of-service.

Business Impact:

• Unauthorized Access: Attackers gain access to resources intended for specific users, including admin panels, internal APIs, or customer data.
• Data Breach: The confidentiality impact is high; if the proxy fronts a database or file storage, PII, financial data, or intellectual property could be exfiltrated.
• Integrity Compromise: Attackers can modify application data, inject malicious content, or change configuration — leading to supply-chain style attacks if the application is a content management platform.
• Reputation Damage: A breach via this CVE erodes customer trust and may trigger regulatory penalties (GDPR, HIPAA, PCI-DSS).

Affected Systems: Any Traefik deployment in the affected version range with BasicAuth middleware and headerField configured. This includes:

• Edge proxies in microservice architectures.
• Reverse proxies for containerized workloads (Kubernetes integration).
• API gateways exposing REST or GraphQL services.
• Load balancers terminating TLS and applying HTTP auth.

Blast Radius: Because Traefik is frequently the ingress point for enterprise microservices, the blast radius extends to all backend services, cloud resources, and stored data behind that entry point. A single successful exploitation could expose an entire application ecosystem.

Detection Guidance

Sigma Rule

title: Traefik BasicAuth Singleflight Key Collision Exploitation
id: 6e9f0c2d-9a8b-4c3e-9f7d-1a2b3c4d5e6f
status: experimental
description: Detects potential exploitation of CVE-2026-71326 leveraging concurrent authentication attempts and forwarded user headers.
logsource:
  category: webserver
  product: traefik
detection:
  selection_forwarded_user:
    http.headers.x_forwarded_user|exists: true
  selection_auth_failure:
    http.response.status_code: 401
  selection_auth_success:
    http.response.status_code: 200
  selection_unusual_credential:
    http.authorization|contains:
      - 'Basic '
  condition: selection_forwarded_user and (selection_auth_failure or selection_auth_success)
  timeframe: 10s
level: high
falsepositives:
  - Legitimate use of X-Forwarded-User header in trusted environments
  - High-volume automated testing of authentication endpoints
tags:
  - attack.t1190
  - cve.2026-71326
  - cwe.287

YARA Rule

rule Traefik_BasicAuth_CVE_2026_71326 {
    meta:
        author = "ValterIT Security Research"
        description = "Detects Traefik BasicAuth middleware code vulnerable to singleflight key collision"
        date = "2026-01-01"
        score = 60
        cve = "CVE-2026-71326"
    strings:
        $s1 = "singleflight" ascii
        $s2 = "basic_auth.go" ascii
        $s3 = "getUserAndPassword" ascii
        $s4 = "headerField" ascii
        $s5 = "X-Forwarded-User" ascii
        $s6 = "password" ascii nocase
        $s7 = "secret" ascii nocase
    condition:
        ($s1 and $s2) or ($s1 and $s3) or ($s1 and $s4) or ($s2 and $s5) or ($s3 and $s6 and $s7)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SERVER Traefik BasicAuth Singleflight Exploitation Attempt (CVE-2026-71326)"; flow:established,to_server; content:"X-Forwarded-User:"; http_header; content:"Authorization: Basic "; http_header; threshold:type threshold, track by_src, count 50, seconds 10; classtype:attempted-admin; sid:20071326; rev:1; reference:cve,2026-71326; metadata:created_at 2026_01_01, updated_at 2026_01_01, attack_target Web_Server, deployment Perimeter, signature_severity Major;)

Elastic Detection

sequence by source.ip, destination.ip
  with maxspan=10s
  [ network where event.type == "connection" and destination.port == 80 or destination.port == 443 ]
  [ http where http.request.method == "GET" and exists(http.request.headers.x_forwarded_user)
      and http.response.status_code == 200 and exists(http.request.authorization) ]
  [ http where http.request.method == "GET" and exists(http.request.headers.x_forwarded_user)
      and http.response.status_code == 401 and exists(http.request.authorization) ]

Splunk SPL Query

index=proxy sourcetype=traefik
| where isnotnull(headers_x_forwarded_user)
| where match(headers_authorization, "(?i)Basic .+")
| bucket _time span=10s
| stats count as auth_attempts, values(headers_x_forwarded_user) as forwarded_users, values(status) as statuses by src_ip, _time
| where auth_attempts > 50
| search statuses IN (200, 401)
| eval rca="Concurrent auth with X-Forwarded-User and high volume — investigate for CVE-2026-71326"
| table _time, src_ip, auth_attempts, forwarded_users, statuses, rca

Wazuh OSSEC Rule

<group name="traefik,">
  <rule id="227227" level="12">
    <decoded_as>json</decoded_as>
    <field name="headers.x-forwarded-user">\.+</field>
    <field name="headers.authorization">Basic .+</field>
    <match>status_code:200|status_code:401</match>
    <description>Traefik BasicAuth middleware suspected exploitation (CVE-2026-71326): high volume of auth requests with forwarded identity.</description>
    <group>authentication_failure,attack,t1190,cve-2026-71326,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1. Immediate Mitigations (within 24–48 hours)

• Disable headerField in the BasicAuth middleware configuration if it is not absolutely required for your deployment. This eliminates the attack vector entirely.
• Restrict access to the authentication endpoint using network-level ACLs (source IP allowlisting) to limit who can reach the middleware.
• Enable rate limiting on the Traefik entrypoint to throttle concurrent authentication requests, reducing the feasibility of the race condition.
• Monitor logs for the detection patterns above and alert on any matching activity.

2. Patch/Upgrade Steps

• Upgrade Traefik to version 3.6.25 (for stable branch) or 3.7.10 (for feature branch). The fix addresses the singleflight key construction by introducing a delimiter that includes the username, preventing cross-user cache collisions.
• Verify the patch by checking the changelog: traefik --version should return the fixed version after upgrade.
• If you cannot upgrade immediately, backport the fix by patching basic_auth.go to include a separator in the singleflight key:

  key := username + ":" + password + ":" + secret
  

• Test all authentication flows thoroughly after patching to ensure no regressions.

3. Long-Term Hardening

• Segment authentication logic: Move away from relying on forwarded headers for identity; use fully trusted authentication proxies (e.g., OAuth2/OIDC) that don't accept client-supplied identity.
• Regular audit of credentials: Rotate all BasicAuth credentials and ensure hashes are stored in access-controlled locations, never in web-accessible paths.
• Implement Web Application Firewall (WAF) rules to block suspicious auth patterns based on the Sigma/YARA detections above.
• Subscribe to Traefik release notifications to ensure timely application of future security patches.
• Conduct penetration testing specifically targeting the authentication middleware after every major release.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71326 — Official NVD record (patch claimed but not independently confirmed).
2. Traefik Security Advisory: Traefik GitHub Security Advisories — vendor disclosure and fix commits for versions 3.6.25 and 3.7.10.
3. Traefik Official Documentation — BasicAuth Middleware: https://doc.traefik.io/traefik/middlewares/http/basicauth/ — documentation detailing headerField usage and configuration, relevant to understanding attack prerequisites.
4. CWE-287 Reference: https://cwe.mitre.org/data/definitions/287.html — MITRE Common Weakness Enumeration entry for improper authentication.
5. MITRE ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application technique used to categorize the attack kill chain.

Threat Actor Activity / Exploit-in-the-Wild Evidence: As of the publication date, there are no confirmed reports of active exploitation in the wild (CISA KEV status: NO). However, the vulnerability is in an open-source web proxy used widely in production environments, and the exploitation prerequisites (valid credential + hash knowledge) lower the barrier for motivated attackers. Enterprise teams should treat this as a High-priority patch candidate and apply fixes proactively, especially in internet-facing deployments.