{"vulnerability": "cve-2026-88010", "sightings": [{"uuid": "aaac5738-b6cb-4174-8837-00f42403f1e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-88010", "type": "published-proof-of-concept", "source": "https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6", "content": "", "creation_timestamp": "2026-09-22T22:35:06.373066Z"}, {"uuid": "cd1bebd0-2f20-47d1-9f0b-60285ba5681b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88010", "type": "seen", "source": "https://gist.github.com/alon710/af64fb0e4974981b0997528347311521", "content": "# CVE-2026-88010: CVE-2026-88010: Unauthenticated Username-Enumeration Timing Oracle in Traefik BasicAuth Middleware\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88010\n\n## Summary\nAn unauthenticated timing oracle vulnerability exists in Traefik's BasicAuth middleware from version 3.6.11 up to (but not including) 3.7.13. By utilizing a request coalescing mechanism (singleflight.Group) that relies on server-side stored secret hashes for key generation, the software introduces a timing discrepancy. Concurrent requests targeting non-existent usernames generate identical singleflight keys and coalesce, resulting in accelerated response times. Conversely, requests targeting valid usernames produce distinct keys and execute independently, allowing remote attackers to systematically enumerate valid usernames.\n\n## TL;DR\nA design flaw in Traefik's BasicAuth singleflight deduplication mechanism allows unauthenticated attackers to discover valid usernames by measuring timing differences during coordinated concurrent requests.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208\n- **Attack Vector**: Network\n- **CVSS Score**: 6.3\n- **EPSS Score**: Not Rated\n- **Impact**: Username Enumeration\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Traefik Proxy (versions v3.6.11 through v3.7.12)\n- **Traefik**: >= 3.6.11, < 3.7.13 (Fixed in: `3.7.13`)\n\n## Mitigation\n\n- Upgrade Traefik instances to version 3.7.13 or above\n- Transition from BasicAuth to Digest Authentication middleware\n- Implement strict concurrency and rate-limiting rules at the load balancer or WAF layer\n\n**Remediation Steps:**\n1. Identify all Traefik instances running versions between 3.6.11 and 3.7.12\n2. Update the deployment container image tag to 3.7.13 or above\n3. Apply the configuration change to the orchestrator (e.g., Kubernetes, Docker Compose)\n4. Monitor the proxy logs for any unexpected 401 Unauthorized spikes post-deployment\n\n## References\n\n- [Traefik Security Advisory](https://github.com/traefik/traefik/security/advisories/GHSA-8fcf-v89g-xpg6)\n- [Fix Commit](https://github.com/traefik/traefik/commit/ddc1bf4660b85fd61fafdd821eb8216fb1a0b130)\n- [Pull Request #13816](https://github.com/traefik/traefik/pull/13816)\n- [Traefik v3.7.13 Release Notes](https://github.com/traefik/traefik/releases/tag/v3.7.13)\n- [CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-88010)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88010) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T23:31:56.672813Z"}]}