DigestAuth: authentication bypass

traefik

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection.

Fix it

traefik

On 2.xUpgrade to traefik 2.11.55
On 3.xUpgrade to traefik 3.7.11

First seen: 25 Oct 2026
Last update: 25 Oct 2026, 00:17 UTC
Fixed in: 3.7.11
2.11.55
Identifiers: CVE-2026-85595
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## DigestAuth: authentication bypass
Severity: critical. Patch status: patched.
Affected: traefik
Fixed in: 3.7.11, 2.11.55
Ids: CVE-2026-85595

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection.

## Steps
1. Search the repo, its CI and infra config for traefik. If present, report the version in use and whether it's affected.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-85595") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c https://nvd.nist.gov/vuln/detail/CVE-2026-85595
https://pwned.coffee/i/digestauth-authentication-bypass-cve-2026-85595

Timeline

25 Oct 2026, 00:17 UTC
Fix status: unknown → patched.
25 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
traefik 3.0.0 to before 3.7.11 3.7.11 NVD
traefik before 2.11.55 2.11.55 CVE record (CNA)
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (NVD) for CVE-2026-85595
Last checked: 25 Oct 2026, 00:17 UTC

Product	Affected	Fixed in	Source
traefik	3.0.0 to before 3.7.11	3.7.11	NVD
traefik	before 2.11.55	2.11.55	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Totalone very hot coffee