Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an… (CVE-2026-85595)

Traefik versions prior to 2.11.55 contain an authentication bypass vulnerability (CVE-2026-85595) in the digestAuth middleware. When an unknown username is provided, the middleware returns an empty secret rather than rejecting the request. Attackers can exploit this by computing a valid digest response using the empty secret and arbitrary credentials, effectively bypassing authentication on any route protected by digestAuth without needing a valid username or password.

Successful exploitation allows an unauthenticated attacker to bypass digest authentication on any protected route, leading to full confidentiality, integrity, and availability compromise of the affected service. This can result in unauthorized access and control over the Traefik-managed resources.

A fix is available in Traefik version 2.11.55. Users should upgrade to version 2.11.55 or later to remediate this vulnerability. No other mitigation is indicated by the vendor advisory.