What’s Vulnerable › Vulnerabilities

CVE-2026-85595: Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-04 · updated 2026-10-08
• Weakness: CWE-287

Description

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

Affected products

• Traefik: before 2.11.55; from 3.0.0 before 3.7.11 — fixed in 2.11.55, 3.7.11

How to fix

Upgrade to a fixed version: Traefik 2.11.55, 3.7.11. Check the vendor advisory for mitigations.

References

• https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c
• https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth

Get alerted when CVE-2026-85595 or the next vulnerability affects your stack