https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:17:41 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-11281 bdu:2026-11281 https://cve.radiocsirt.org/vuln/bdu:2026-11281 https://cve.radiocsirt.org/vuln/euvd-2026-349490 EUVD-2026-349490 https://cve.radiocsirt.org/vuln/euvd-2026-349490 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71326 <p>Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik&#39;s BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.</p> <p>Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik&#39;s BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71326 https://cve.radiocsirt.org/vuln/ghsa-6765-c87h-8mrf <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a low severity vulnerability in Traefik&#39;s BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured username — whose secret is empty — can produce the same key as a configured user&#39;s valid request and receive that request&#39;s successful result. Exploitation requires the attacker to already hold a valid credential **and** to read the stored password hash, which is only reachable through paths that are themselves privileged: the API is documented as admin-only, the Kubernetes path requires read access to the Secret, and the Docker path requires access to the socket. The key now encodes the password length as a prefix, so distinct (password, secret) pairs can no longer collide. Only the v3.6 line from v3.6.11 onwards and the v3.7 line are affected; earlier v3 releases and the v2 line do not carry the vulnerable deduplication path.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.25 - https://github.com/traefik/traefik/releases/tag/v3.7.10</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Summary</p> <p>Traefik&#39;s BasicAuth middleware deduplicates concurrent password checks with a `singleflight.Group`. Its key is the de…</p> <p><strong>Affected:</strong> Go: github.com/traefik/traefik/v3</p> <p>## Summary</p> <p>There is a low severity vulnerability in Traefik&#39;s BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured username — whose secret is empty — can produce the same key as a configured user&#39;s valid request and receive that request&#39;s successful result. Exploitation requires the attacker to already hold a valid credential **and** to read the stored password hash, which is only reachable through paths that are themselves privileged: the API is documented as admin-only, the Kubernetes path requires read access to the Secret, and the Docker path requires access to the socket. The key now encodes the password length as a prefix, so distinct (password, secret) pairs can no longer collide. Only the v3.6 line from v3.6.11 onwards and the v3.7 line are affected; earlier v3 releases and the v2 line do not carry the vulnerable deduplication path.</p> <p>## Patches</p> <p>- https://github.com/traefik/traefik/releases/tag/v3.6.25 - https://github.com/traefik/traefik/releases/tag/v3.7.10</p> <p>## For more information</p> <p>If you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).</p> <p>&lt;details&gt; &lt;summary&gt;Original Description&lt;/summary&gt;</p> <p>## Summary</p> <p>Traefik&#39;s BasicAuth middleware deduplicates concurrent password checks with a `singleflight.Group`. Its key is the de…</p> https://cve.radiocsirt.org/vuln/ghsa-6765-c87h-8mrf