by Kastro
Paper/Archive/CVE-2026-85595

CVE-2026-85595

traefik traefik — Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 84.3.843 × 2016.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

Affected

ProductAffectedFixed inSource
traefik< 2.11.552.11.55CNA
traefik3.0.0 – 3.7.10–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64cwriteupvulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth