Is CVE-2026-41263 actively exploited?

No active exploitation of CVE-2026-41263 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41263 be exploited remotely?

Yes. CVE-2026-41263 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41263?

CVE-2026-41263 has a CVSS score of 3.7 (LOW).

HOME VULNERABILITIESCVE-2026-41263

LOW

CVE-2026-41263

CWE-208Published: April 30, 2026· Updated: May 1, 2026

3.7

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:2.1th

Official Description

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a timing side-channel vulnerability in Traefik's BasicAuth middleware that allows an attacker to enumerate valid usernames through response-time differences. The variable intended to hold a constant-time fallback secret always resolves to an empty string, causing the constant-time comparison to short-circuit in microseconds rather than performing a full bcrypt evaluation. This restores the original timing oracle and makes it possible to distinguish existing users from non-existing ones by measuring authentication response times. This issue has been patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

NVD Source

Technical Analysis

CVE-2026-41263 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.