CVE-2026-85595: Traefik digestAuth Bypass Vulnerability

CVE-2026-85595 Overview

CVE-2026-85595 is an authentication bypass vulnerability in the Traefik reverse proxy and load balancer. The flaw resides in the digestAuth middleware, which handles HTTP Digest Access Authentication for protected routes. When a client presents an unknown username, the middleware returns an empty secret instead of rejecting the request outright. Attackers can compute a valid digest response using that empty secret and arbitrary credentials, gaining access to any digestAuth-protected route without a valid username or password. The issue is tracked under [CWE-287] (Improper Authentication).

Critical Impact
Unauthenticated network attackers can bypass digest authentication on any Traefik route protected by the digestAuth middleware, exposing backend services without any valid credentials.

Affected Products

Traefik versions before v2.11.55
Traefik versions v3.0.0 through v3.7.10
Any deployment relying on the Traefik digestAuth middleware for route protection

Discovery Timeline

2026-09-04 - CVE-2026-85595 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85595

Vulnerability Analysis

Traefik's digestAuth middleware implements HTTP Digest Access Authentication as defined by RFC 7616. The middleware validates client-supplied credentials by looking up the username in a configured user store and recomputing the expected digest response using the stored secret. Under correct behavior, an unknown username must terminate authentication with a challenge or rejection.

In the affected versions, the lookup path for an unknown username returns an empty string instead of failing closed. The middleware then proceeds to compute the expected digest response using that empty secret. An attacker who knows the algorithm can supply any username and produce a matching response, satisfying the middleware and reaching the protected backend.

The flaw is exploitable over the network with no privileges, no user interaction, and low attack complexity. It compromises the confidentiality, integrity, and availability of every service sitting behind a digestAuth-protected route.

Root Cause

The root cause is a fail-open condition in the credential lookup logic of the digestAuth middleware. Instead of treating a missing user record as an authentication failure, the code returns an empty secret and continues the digest verification flow. Empty-string secrets produce deterministic, attacker-computable HA1 and response values, allowing forged authorization headers to validate successfully.

Attack Vector

An unauthenticated remote attacker sends a normal HTTP request to any route guarded by digestAuth. Traefik responds with a 401 Unauthorized and a WWW-Authenticate: Digest challenge containing the realm, nonce, and algorithm parameters. The attacker constructs an Authorization: Digest header using an arbitrary username, the provided nonce and realm, and a response value computed with an empty secret as the HA1 input. Traefik accepts the request as authenticated and proxies it to the backend. No prior knowledge of valid accounts, credentials, or session state is required.

No verified exploit code is currently published. See the GitHub Security Advisory GHSA-5w68-77r2-r64c and the VulnCheck Advisory on Traefik for further technical context.

Detection Methods for CVE-2026-85595

Indicators of Compromise

Successful 2xx responses on digestAuth-protected routes following requests carrying Authorization: Digest headers with usernames not present in your configured user store.
Repeated authentication attempts against digestAuth endpoints from a small set of source IPs, followed by successful access using non-existent usernames.
Backend application logs showing authenticated activity for user identifiers that do not exist in the identity provider or htdigest file.

Detection Strategies

Parse Traefik access logs and correlate the ClientUsername field with the authoritative list of provisioned digest users; flag any successful request where the username is unknown.
Deploy signatures in your web application firewall or reverse proxy layer that alert when a digestAuth-protected path returns success for a username outside an allow list.
Run version inventory checks across Kubernetes ingress controllers and container images to identify Traefik instances running vulnerable versions.

Monitoring Recommendations

Enable Traefik access logging in JSON mode and forward events to a centralized analytics platform for continuous review of authentication outcomes.
Alert on spikes in 401 to 200 state transitions on digest-protected routes, which can indicate credential-forgery probing.
Track the Traefik binary and container image versions in your configuration management database, and generate a ticket for any node still running an affected release.

How to Mitigate CVE-2026-85595

Immediate Actions Required

Upgrade Traefik to v2.11.55 or v3.7.11 (or later) on every ingress and gateway node.
Audit all routers and middleware chains for use of digestAuth and confirm the fixed version is in place before restoring traffic.
Rotate any secrets, session tokens, or API keys that may have been exposed through a digestAuth-protected route since the vulnerable version was deployed.

Patch Information

The Traefik maintainers fixed the fail-open lookup so that unknown usernames now terminate authentication rather than yielding an empty secret. Patched releases are Traefik v2.11.55 for the 2.x branch and v3.7.11 for the 3.x branch. Full remediation details are documented in the GitHub Security Advisory GHSA-5w68-77r2-r64c.

Workarounds

Replace digestAuth with basicAuth over TLS or an external authentication provider via forwardAuth until patched binaries are deployed.
Restrict network reachability to digestAuth-protected routes using firewall rules, service mesh policies, or IP allow lists.
Place a secondary authentication layer, such as mutual TLS or an identity-aware proxy, in front of Traefik for high-value backends.

bash

# Example: swap digestAuth for basicAuth in a Traefik dynamic configuration
# (temporary mitigation until upgrading to v2.11.55 or v3.7.11)
http:
  middlewares:
    protected-auth:
      basicAuth:
        users:
          - "admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/"
        removeHeader: true
  routers:
    api-router:
      rule: "Host(`api.example.com`)"
      service: api-service
      middlewares:
        - protected-auth
      tls: {}