CVE-2026-41263: 
NixOS vulnerability analysis and mitigation

CVE-2026-41263 is a timing side-channel vulnerability in Traefik's BasicAuth middleware that enables unauthenticated attackers to enumerate valid usernames by measuring authentication response-time differences. It was disclosed on April 24, 2026, and published to the National Vulnerability Database on April 30, 2026. Affected versions include Traefik v1.x (all versions ≤ 1.7.34, no patch available), v2.x (< 2.11.43), v3.x (3.0.0-beta1 to < 3.6.14), and v3.7.0-ea.1 to < 3.7.0-rc.2. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Traefik Advisory).

The root cause is a map key/value confusion bug in basic_auth.go (line 49), classified as CWE-208 (Observable Timing Discrepancy). The variable notFoundSecret, intended to hold a constant-time fallback bcrypt hash for non-existent users, always resolves to an empty string because the code performs users[slices.Collect(maps.Values(users))[0]] — looking up a hash value as a username key and returning "". When an unknown username is submitted, goauth.CheckSecret(password, "") is called; the empty string matches no bcrypt/MD5 prefix, causing bytes.SplitN("", "$", 4) to return length 1 and the function to return in ~1 µs. In contrast, a valid username triggers a full bcrypt evaluation taking ~60 ms, creating a measurable timing oracle with a median ratio of ~130x between existing and non-existing users (Github Advisory, Traefik Advisory). This vulnerability is effectively a regression from the prior fix for CVE-2026-32595, rendering that patch a no-op.

Successful exploitation allows an unauthenticated remote attacker to reliably distinguish valid usernames from invalid ones by measuring HTTP authentication response times, with a demonstrated classification accuracy of 8/8 in black-box testing. While the direct impact is limited to confidentiality of username information (no integrity or availability impact on the vulnerable system itself), the enumerated usernames can significantly reduce the search space for subsequent brute-force or credential-stuffing attacks against Traefik-protected services. This increases the risk of full authentication bypass and unauthorized access to backend systems protected by the BasicAuth middleware (Github Advisory, Traefik Advisory).

A black-box proof-of-concept exploit (poc/exploit.py, a Python timing oracle script) was included in the original vulnerability report submitted by researcher "kodareef5" and is referenced in the GitHub advisory, demonstrating practical exploitability (Github Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time (Feedly). The EPSS score is approximately 0.022% (6th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires high attack complexity due to the need for precise network timing measurements.

1. Reconnaissance: Identify Traefik instances using BasicAuth middleware via Shodan, Censys, or direct probing of HTTP endpoints that return WWW-Authenticate: Basic headers.
2. Baseline timing measurement: Send multiple authentication requests with a known non-existent username and record response times to establish a baseline (~0.35–0.48 ms median).
3. Username probing: For each candidate username from a wordlist, send repeated HTTP requests with an incorrect password (e.g., Authorization: Basic base64(candidate:wrongpassword)) to the target endpoint.
4. Timing analysis: Measure and aggregate response times for each candidate. Usernames that trigger bcrypt evaluation will return in ~57–63 ms, while non-existent usernames return in < 1 ms — a ~130x median ratio.
5. Classification: Apply a statistical threshold (e.g., median response > 10 ms) to classify candidates as valid or invalid usernames with high accuracy (demonstrated 8/8 correct in PoC).
6. Follow-on attack: Use the enumerated valid usernames as targets for brute-force or credential-stuffing attacks to achieve full authentication bypass (Github Advisory, Traefik Advisory).

• Network: High volume of HTTP requests to BasicAuth-protected endpoints with varying usernames but consistent (incorrect) passwords from a single or small set of source IPs; requests arriving in rapid succession with statistical regularity suggesting automated timing measurement.
• Logs: Traefik access logs showing repeated 401 Unauthorized responses to the same endpoint from the same source IP with many different Authorization header values; unusually high request rates to authenticated routes without successful logins.
• Behavioral: Patterns of authentication attempts cycling through a username wordlist rather than random or credential-stuffing patterns; requests with identical passwords but varying usernames across hundreds or thousands of attempts.

Traefik has released patched versions that correctly implement constant-time comparison for BasicAuth validation: v2.11.43, v3.6.14, and v3.7.0-rc.2 (Traefik v2.11.43, Traefik v3.6.14, Traefik v3.7.0-rc.2). The fix removes the erroneous map lookup that caused notFoundSecret to always be an empty string (PR #12960). No patch is available for Traefik v1.x (≤ 1.7.34); users on that branch should migrate to a supported version. As interim mitigations, implement rate limiting on authentication endpoints and consider adding network-level controls (e.g., IP allowlisting) to restrict access to BasicAuth-protected routes.

Traefik published an official community forum post announcing the security update covering multiple CVEs including CVE-2026-41263 (Traefik Community). The vulnerability was reported by researcher "kodareef5" who provided a detailed root-cause analysis and working PoC, noting that the prior CVE-2026-32595 fix was effectively a no-op due to the map key/value confusion bug. The release of v3.6.14 received notable community engagement on GitHub with positive reactions from multiple contributors.