CVE-2026-85595

UNKNOWN 0.0

Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

CVSS Score

0.0

EPSS Score

0.7%

EPSS Percentile

51th

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

CWE	CWE-287
Vendor	traefik
Product	traefik
Published	Sep 4, 2026
Last Updated	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for traefik traefik

Be the first to know when new unknown vulnerabilities affecting traefik traefik are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

traefik / traefik

0 < 2.11.55

traefik / traefik

3.0.0 ≤ 3.7.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c vulncheck.com: https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth

Credits

🔍 matiasinsaurralde