https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T16:15:09.770519+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0333 certfr-2026-avi-0333 — De multiples vulnérabilités ont été découvertes dans Traefik. Elles permettent à un attaquant de provoquer une atteinte… 2026-10-02T16:15:09.841459+00:00 certfr-2026-avi-0333 https://cve.radiocsirt.org/vuln/cleanstart-2026-bt02769 CLEANSTART-2026-BT02769 — Security fix for CVE-2026-32595 applied in: forecastle 1.0.159-r1 2026-10-02T16:15:09.841506+00:00

Affected: CleanStart: forecastle

Security vulnerability affects the forecastle package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-276665 EUVD-2026-276665 2026-10-02T16:15:09.841539+00:00 EUVD-2026-276665 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32595 fkie_cve-2026-32595 2026-10-02T16:15:09.841553+00:00

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea.1 comtain BasicAuth middleware that allows username enumeration via a timing attack. When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames. This issue is patched in versions 2.11.41, 3.6.11 and 3.7.0-ea.2.

 https://cve.radiocsirt.org/vuln/ghsa-g3hg-j4jv-cwfr GHSA-g3hg-j4jv-cwfr — Traefik Affected by BasicAuth Middleware Timing Attack Allows Username Enumeration 2026-10-02T16:15:09.841579+00:00

Affected: Go: github.com/traefik/traefik, Go: github.com/traefik/traefik/v2, Go: github.com/traefik/traefik/v3

## Summary

There is a potential vulnerability in Traefik's BasicAuth middleware that allows username enumeration via a timing attack.

When a submitted username exists, the middleware performs a bcrypt password comparison taking ~166ms. When the username does not exist, the response returns immediately in ~0.6ms. This ~298x timing difference is observable over the network and allows an unauthenticated attacker to reliably distinguish valid from invalid usernames.

## Patches

- https://github.com/traefik/traefik/releases/tag/v2.11.41 - https://github.com/traefik/traefik/releases/tag/v3.6.11 - https://github.com/traefik/traefik/releases/tag/v3.7.0-ea.2

## For more information

If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).

<details> <summary>Original Description</summary>

### Summary A timing attack vulnerability exists in Traefik's BasicAuth middleware that allows unauthenticated attackers to enumerate valid usernames. When a username exists, bcrypt password verification takes ~166ms; when it doesn't exist, the response returns immediately in ~0.6ms. This ~298x timing difference enables reliable username enumeration.

### Details The vulnerability exists in the BasicAuth middleware implementation. When validating credentials: - User exists: The system performs bcrypt password comparison, which intentionally takes ~100-200ms due to bcrypt's design - User doesn't exist: The system immediately re…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10444-1 openSUSE-SU-2026:10444-1 — traefik-3.6.12-1.1 on GA media 2026-10-02T16:15:09.841637+00:00

traefik-3.6.12-1.1 on GA media