Bug 2529027 (CVE-2026-85595)

Summary: CVE-2026-85595 github.com/traefik/traefik: Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: unspecifiedCC: anjoseph, jprabhak, sdawley, wtam
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
An authentication bypass vulnerability was discovered in Traefik's digestAuth middleware. When an incoming request contains a username that does not exist in the configured authentication store, the application fails to reject the request and instead evaluates the credential against an empty string secret. An unauthenticated remote attacker can exploit this flaw by generating a valid HTTP Digest Authentication header calculated using an empty secret and an arbitrary password, successfully bypassing authentication controls and gaining unauthorized access to routes protected by the digestAuth middleware.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-05 10:41:14 UTC 
Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.