CVE-2026-85595criticalCWE-287

CVE-2026-85595: critical vulnerability in traefik

Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

Published · Updated

Follow this CVE+ Monitor traefik

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.3epss 2.5%
from disclosure to weapon51 days
Published on NVDSep 4
1st PoC+51d
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
traefik · traefik
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — traefik

In the same product, most dangerous first.

CVE-2022-23632HIGHTraefik skips the router TLS configuration when the host header is an FQDNEPSS 1.7%CVE-2024-45410CRITICALHTTP client can remove the X-Forwarded headers in TraefikEPSS 1.5%CVE-2025-54386HIGHTraefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code ExecutionEPSS 1.4%CVE-2022-39271HIGHTraefik HTTP/2 connections management could cause a denial of serviceEPSS 1.4%CVE-2023-47633HIGHUncontrolled Resource Consumption in TraefikEPSS 1.3%CVE-2021-32813MEDIUMDrop Headers via Malicious Connection HeaderEPSS 1.1%