/Vulnerability Library

Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass

CVE-2026-85595
Early Release

Description

Traefik < 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.

Severity

Critical

CVSS Score

9.8

Exploit Probability

1%

Affected Product

traefik

Published Date

October 25, 2026

Template Author

boreas37

CVE-2026-85595.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-85595
CWE ID:
cwe-287

References

https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64chttps://github.com/containous/go-http-auth/commit/b975dcaa8c48https://github.com/traefik/traefik/commit/2116686308a2https://nvd.nist.gov/vuln/detail/CVE-2026-85595

Remediation Steps

Update to version 2.11.55 or later.