Critical severity · published Sep 4, 2026
CVE-2026-85595
Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TR
traefik · traefik
before 2.11.55; 3.0.0 through 3.7.10 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85595
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85595
vendor-advisory
https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c
third-party-advisory
https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth
More from traefik
10.0
CVE-2026-54763
Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth
10.0
CVE-2026-53622
Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts
10.0
CVE-2026-48491
Traefik: SNICheck ignores wildcard TLSOptions mappings, allowing domain-fronted mTLS bypass
10.0
CVE-2026-48020
Traefik StripPrefix Route-Level Auth Bypass via Path Normalization
10.0
CVE-2026-39858
Traefik: Forwarded alias spoofing top pre-auth decision bypass