CVE-2026-85595 Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
Attackers can bypass digestAuth authentication in Traefik by using an empty secret, allowing unauthorized access to protected routes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-85595?
CVE-2026-85595 is a critical authentication bypass vulnerability in Traefik Traefik, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.
Weakness: CWE-287
Which versions are affected by CVE-2026-85595?
It affects 1 product.
Products include Traefik Traefik.
How do I fix CVE-2026-85595?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85595 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85595 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Traefik Traefik
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2026-88877 Traefik v3.7.0 Authentication Bypass via from-to-www-redirect
- CVE-2026-88007 Traefik HTTP/3 Backend NTLM Connection Reuse
- CVE-2026-88009 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- CVE-2025-32431 Traefik has a possible vulnerability with the path matchers
Sources
Also known as GHSA-4v96-rv7j-9wmr, GHSA-5w68-77r2-r64c, MINI-62vx-jwcp-f495, MINI-c6mp-gc5p-9j7x, MINI-j98f-hw2h-w48x.