THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-85595 — Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty sec

[NVD] CVE-2026-85595 — Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty sec

mednvdPublished 2026-09-04

CVE-2026-85595 CVSS: None Published: 2026-09-04T12:17:22.960

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-85595cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-85595