CVE-2026-85595
Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- Published
- Sep 4, 2026
- Updated
- Oct 8, 2026
- Assigning CNA
- VulnCheck
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XLow · next 30 days
- Percentile
- 84.4%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.
Sources
http/cves/2026/CVE-2026-85595.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.