CVE-2026-85595 is a complete authentication bypass in the Traefik digestAuth middleware (CVSS 9.8, critical). An unknown username received an empty secret, so a valid response was computable without a password. Upgrade to v2.11.55 or v3.7.11. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The advisory lists Traefik up to v2.11.54 and from v3.0.0 through v3.7.10. Patched versions are v2.11.55 and v3.7.11. The weakness is CWE-287, improper authentication.
The secret provider returned an empty string for a username not in the configured list, and the pinned digest library accepted it as the user's HA1 value. Any unauthenticated client could then pass the check on any route protected by digestAuth, including the dashboard and API if protected that way. The advisory says every v1, v2 and v3 release with the middleware is affected, and unmaintained lines will not receive fixes. The record is not in the CISA KEV catalog.
How to check if you're exposed
Search your Traefik configuration for the middleware.
grep -rn "digestAuth" /etc/traefik/ ./config/ 2>/dev/null
For Kubernetes, search your Middleware resources for digestAuth. Then check the Traefik version in the running image. If a route is protected only by digestAuth, treat it as unprotected until you upgrade.
What to do now
- Upgrade to v2.11.55 or v3.7.11 or later.
- If you run an unmaintained line such as v1 or v2 below 2.11, move to a supported one.
- Until then, replace digestAuth on sensitive routes with another method, or restrict those routes by network.
- Check access logs on digestAuth routes for requests you do not recognize.
- Rotate secrets that sit behind routes protected only by digestAuth.
Why it matters
In digest authentication, the server and client both compute a hash from a shared secret plus values the server sent. If the server uses an empty secret for an unknown user, the client can compute the same hash, because every other input is public.
The fix is simple to state: unknown user means reject. The error came from returning a value instead of signalling absence, a pattern worth searching for in your own code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect basicAuth?
The advisory is about the digestAuth middleware. It does not describe basicAuth as affected.
Sources
Last reviewed: 19 October 2026.
