Authentication Bypass in Traefik by Emulating Empty Secrets in DigestAuth Middleware

CVE-2026-85595

What is CVE-2026-85595?

Traefik versions prior to v2.11.55 are susceptible to an authentication bypass vulnerability present in the digestAuth middleware. This flaw allows attackers to exploit a scenario where unknown usernames are given an empty secret, leading to an absence of rejection during authentication attempts. Consequently, malicious actors can generate a valid digest response using arbitrary credentials to gain unauthorized access to routes that are protected by digestAuth, all without needing a legitimate username or password.

References