p PatchFirst

CVE-2026-85595

CVE-2026-85595 · Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

CVSS 9.3 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: web

Affected products and versions

  • traefik

    Versions
    • ≥ 0, < 2.11.55: Affected (semver)
    • 2.11.55: Not affected (semver)

    Update to 2.11.55

  • traefik

    Versions
    • ≥ 3.0.0, ≤ 3.7.10: Affected (semver)

    No fix published

Original sources

Check your server →