CVE-2026-85595Critical· 9.8▾ MidnightTraefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
— → 9.1
none → critical
Last analysed / modified upstream
9.1 → 9.8
0.4% → 0.4%
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.
traefik < 2.11.55traefik >= 3.0.0, < 3.7.11Upgrade past the affected range:
traefik 3.7.11Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-85596Critical· 9.8Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider
CVE-2026-71326Low· 3.8Traefik is an open source HTTP reverse proxy and load balancer
CVE-2026-88877Critical· 9.8Traefik is a HTTP reverse proxy and load balancer
CVE-2026-88878Medium· 5.3Traefik is an HTTP reverse proxy and load balancer
CVE-2026-88879High· 8.2Traefik is an HTTP reverse proxy and load balancer
CVE-2026-85594Critical· 9.8Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation in the Kubernetes Ingress provider