CVE-2026-88010

Executive Summary

CVE-2026-88010 is a username enumeration vulnerability in Traefik's BasicAuth middleware affecting versions 3.6.11 through 3.7.12. Concurrent, unauthenticated requests coalesce on a single singleflight key derived from the submitted password rather than being isolated per username, producing a measurable timing discrepancy that reveals whether a configured username exists. The issue does not disclose credentials or bypass authentication, but it provides an oracle for username enumeration that can enable follow-on credential attacks against exposed Traefik dashboards and proxied applications.

Technical Analysis

The vulnerability resides in the BasicAuth middleware implementation, specifically in the checkPassword function located in pkg/middlewares/auth/basic_auth.go. The function constructs a singleflight key for concurrent authentication requests. According to the NVD description, this key is derived from "the submitted password and stored secret" rather than incorporating the submitted username.

Singleflight is a request-coalescing pattern that suppresses duplicate concurrent calls for the same key, executing the underlying operation once and returning the shared result to all callers. Under normal operation, this optimizes expensive operations such as password hashing when many clients request the same resource with identical credentials.

The flaw in CVE-2026-88010 is the composition of the coalescing key. Because the key does not include the username, requests targeting a nonexistent username and requests targeting a nonexistent password path may collide on the same key. When the submitted username is absent from the configured credential set, Traefik's authentication flow does not proceed to a per-username password hash comparison. When the username exists, a distinct per-user password hash is performed. The result is a measurable timing differential between:

• Absent username: requests coalesce/complete without per-user hash work, responding faster.
• Configured username: requests trigger an individual password hash, responding slower.

An unauthenticated remote attacker can measure this timing differential across many requests to distinguish valid from invalid usernames. The NVD description explicitly notes that sequential checks remain cost-equalized — meaning the discrepancy only manifests under concurrent request conditions that force the coalescing path. The advisory also confirms:

• Traefik v2 is not affected.
• Digest authentication is not affected.
• Credentials are not disclosed.
• Authentication is not bypassed.

This is a classic CWE-208 (Observable Timing Discrepancy) issue used for account discovery (MITRE T1087).

Exploitation Scenarios

No public proof-of-concept exists. The attack chain is inferred from the vulnerability class and the behavior described in the NVD description.

1. Reconnaissance / Target Identification. An attacker identifies internet-exposed Traefik instances via Shodan, Censys, or scanning. The BasicAuth middleware must be configured on one or more routers. The attacker enumerates usernames of interest (common admin accounts, service accounts referenced in public documentation, or names harvested from application error messages).

2. Triggering the Flaw. The attacker sends many concurrent BasicAuth requests against a protected route — high concurrency is required because the singleflight coalescing condition only triggers under concurrency. Candidate usernames are submitted with arbitrary (invalid) passwords. By measuring response latency distributions for each candidate username and comparing them against a known-bad baseline, the attacker derives a timing signal.

3. Signal Extraction. Usernames present in the configured credential store appear slower due to the per-user password hash. Absent usernames appear faster because they coalesce and short-circuit. Statistical aggregation across thousands of requests is required to overcome network jitter.

4. Execution Layer. No payload injection or code execution occurs. The "exploit" is purely a side-channel oracle. There is no credential disclosure and no auth bypass; the attacker only learns which usernames exist.

5. Post-Exploitation Impact. Enumerated valid usernames become inputs to credential stuffing, password spraying, or social engineering campaigns. Combined with credential leaks from unrelated breaches, a valid username materially increases attacker success rates against the same Traefik instance and downstream applications behind it.

Impact Assessment

• Confidentiality: Low — usernames disclosed.
• Integrity: None — no data modification is possible via this flaw.
• Availability: None.
• Attack Vector: Network (AV:N) — remotely exploitable against exposed endpoints.
• Attack Complexity: High (AC:H) — requires precise timing measurement, concurrency, and statistical analysis; noisy networks degrade signal.
• Privileges Required: None (PR:N).
• User Interaction: None (UI:N).
• Scope: Unchanged (S:U).

Business impact is indirect. Traefik is widely deployed as an edge reverse proxy in Kubernetes and Docker environments. Any organization using BasicAuth on publicly reachable routers — including the Traefik dashboard, internal admin endpoints, or legacy services fronted by Traefik — is exposed to username enumeration. The blast radius is bounded to identity disclosure, but username enumeration is a well-established precursor to credential attacks and increases the value of subsequent exploitation stages. Environments with predictable username schemes (e.g., admin, ops, service-account names derived from org conventions) face higher risk.

Detection Guidance

Sigma Rule

title: Traefik BasicAuth Username Enumeration via Timing Anomaly
id: 8c2f1a44-9b7e-4d21-a3b5-4c1f8e9d2a10
status: experimental
description: Detects repeated 401 responses on BasicAuth-protected Traefik routes from a single source, consistent with concurrent timing-based username enumeration (CVE-2026-88010).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-88010
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: traefik
detection:
  selection_status:
    status: 401
  selection_auth:
    cs-method: 'GET'
    cs-uri-query|contains: ''
  timeframe: 60s
  condition: selection_status | count() by src_ip > 50
fields:
  - src_ip
  - cs-uri-stem
  - cs-username
falsepositives:
  - Legitimate users repeatedly entering wrong passwords
  - Monitoring systems probing auth endpoints
level: medium
tags:
  - attack.discovery
  - attack.t1087
  - cve.2026.88010

YARA Rule

rule CVE_2026_88010_Traefik_BasicAuth_Timing
{
    meta:
        author = "valtersit.com"
        description = "Detects Traefik builds containing the vulnerable checkPassword singleflight key construction described in CVE-2026-88010"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-88010"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $f1 = "checkPassword" ascii
        $f2 = "pkg/middlewares/auth/basic_auth.go" ascii
        $f3 = "singleflight" ascii
        $v1 = "v3.6.11" ascii
        $v2 = "v3.7.12" ascii
    condition:
        uint32(0) == 0x464C457F and
        $f1 and $f2 and $f3 and any of ($v*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-88010 Traefik BasicAuth Username Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.response_stat_code; content:"401"; threshold:type both, track by_src, count 60, seconds 60; classtype:attempted-recon; reference:cve,2026-88010; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-88010; sid:9000101; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [http where http.response.status_code == 401 and http.request.method == "GET"] with runs=50

Splunk SPL Query

index=web sourcetype=traefik OR sourcetype=access_combined
| where status=401 AND method="GET"
| bin _time span=1m
| stats count AS fails dc(uri) AS paths by src_ip, _time
| where fails >= 50
| sort -fails
| table _time, src_ip, fails, paths

Wazuh OSSEC Rule

<group name="traefik,web,cve-2026-88010,">
  <rule id="100510" level="8" frequency="60" timeframe="60">
    <if_matched_sid>31101</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-88010: Possible Traefik BasicAuth username enumeration - high volume of 401 responses from $(srcip)</description>
    <mitre>
      <id>T1087</id>
    </mitre>
    <group>recon_attempt,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate Mitigations

• Upgrade to Traefik 3.7.13 — the NVD description states this is the fixed version. Confirm the version in the running binary before declaring closure.
• If an immediate upgrade is not operationally feasible, restrict network access to BasicAuth-protected routes via network policy, WAF rules, or IP allowlisting so that untrusted clients cannot reach the middleware.
• Reduce exposure of the Traefik dashboard and admin endpoints; bind to internal interfaces only.
• Enable rate limiting on authentication-protected routers to make large-scale timing measurements impractical.
• Avoid predictable usernames in the credential store where the credential system allows it.

2) Patch / Upgrade Steps

• For Kubernetes: bump the Traefik Helm chart / image tag to 3.7.13 or later and roll the deployment.
• For Docker Compose or bare-metal: pull the 3.7.13+ image, validate configuration compatibility, and restart. Verify traefik version output post-upgrade.
• After upgrade, confirm BasicAuth behavior is unchanged for legitimate users and re-run any existing authentication regression tests.

3) Long-Term Hardening

• Replace BasicAuth with modern authentication (OIDC, mTLS, or token-based schemes) on internet-exposed routers.
• Baseline timing distributions for authentication endpoints and alert on statistically significant latency drift.
• Treat username enumeration as a first-class signal feeding credential-stuffing defenses (rate limits, velocity checks, breach-corpus correlation).
• Include Traefik version tracking in asset inventory so future advisories can be matched against deployed edge proxies quickly.

References

1. NVD — CVE-2026-88010: https://nvd.nist.gov/vuln/detail/CVE-2026-88010
2. MITRE CWE-208 — Observable Timing Discrepancy: https://cwe.mitre.org/data/definitions/208.html
3. MITRE ATT&CK T1087 — Account Discovery: https://attack.mitre.org/techniques/T1087/
4. Traefik project releases (verify 3.7.13 availability): https://github.com/traefik/traefik/releases
5. CISA Known Exploited Vulnerabilities catalog (CVE-2026-88010 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is currently available for CVE-2026-88010. No evidence of active exploitation in the wild or association with a named threat actor campaign has been observed at the time of writing. EPSS scoring has not yet been assigned by FIRST.org.