Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85595Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

Critical 9.3

In plain English

A critical-severity improper authentication in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)2.5%top 15.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

Affected products (as reported)

Vendor	Product	Versions
traefik	traefik	0 – before 2.11.55
traefik	traefik	3.0.0 – through 3.7.10

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-5w68-77r2-r64c) vendor-advisory
VulnCheck Advisory: Traefik before v2.11.55 Authentication Bypass via digestAuth third-party-advisory