CVE-2026-85595

Description

Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

References

• https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c
• https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth