External risk intelligence

Traefik DigestAuth Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-85595

Traefik is a widely deployed edge router, reverse proxy, and ingress controller designed specifically to manage, secure, and expose web applications and API traffic to the internet. Authentication middleware in such edge components is inherently public-facing by design.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Traefik's digest authentication could allow unauthorized access to protected routes. This issue arises from how the system handles unknown usernames, potentially enabling attackers to bypass security measures. The main concern is to confirm if this technology is in use and assess potential exposure.

Bypass security for protected routes.
Protects critical public-facing network access.
Confirm usage and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending unauthenticated requests to a Traefik instance configured with the digestAuth middleware. The vulnerability lies in how the middleware handles requests with unknown usernames, providing an empty secret instead of rejecting them. This allows an attacker to craft a valid digest response using this empty secret, bypassing authentication for any route protected by digestAuth, potentially leading to unauthorized access.

No prior authentication required.
Crafted digest response bypasses checks.
Unauthorized access to protected routes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication controls on routes protected by the digestAuth middleware. When an unknown username is provided, the middleware incorrectly responds with an empty secret instead of rejecting the request. An attacker can leverage this to craft a valid digest response, effectively bypassing authentication when supported by the advisory.

Protected routes and their access.
Bypassing authentication with crafted responses.
Unauthorized access to resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The digestAuth middleware in Traefik is likely managed by platform or infrastructure teams responsible for ingress and edge services. The first step is to inventory all Traefik instances, confirm which ones use the digestAuth middleware, and determine their exposure and criticality before planning remediation.

Identify Traefik instances using digestAuth middleware.
Verify exposure and business criticality of affected systems.
Plan coordinated remediation with the platform team.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Traefik and how is it used?

Traefik is a modern edge router and reverse proxy that manages and secures traffic flowing into web applications and APIs. It acts as an ingress controller, sitting between the public internet and backend services to handle tasks like routing requests and enforcing security policies, such as authentication, before traffic reaches your internal infrastructure.

What does CWE-287 mean for CVE-2026-85595?

CWE-287 refers to Improper Authentication. In this specific case, Traefik's digestAuth middleware fails to properly verify user identities. When a request includes an unknown username, the software mistakenly provides an empty secret instead of denying the request. This flaw allows an unauthorized person to complete the authentication handshake using that empty secret, effectively tricking the system into granting access as if they were a valid, authenticated user.

How does an attacker trigger this authentication bypass?

An attacker triggers this by sending a specially crafted HTTP request to a route protected by the digestAuth middleware. By providing an unknown username, they force the system to use an empty secret. They do not need a valid password or prior access to the system. Importantly, this issue only occurs when the digestAuth middleware is actively configured and enabled; routes protected by other authentication methods are not affected by this specific logic error.

Is my network at risk from this vulnerability?

Halo Surface Signal notes that Traefik is often used as a public-facing edge component, making it inherently exposed to the internet. If you use Traefik's digestAuth middleware on your internet-facing routes, those systems are at high risk. You should be especially concerned if your ingress controllers handle sensitive traffic or provide access to internal services, as the vulnerability bypasses the security layer that normally prevents unauthorized entry.

How should I respond if I use Traefik?

Start by identifying all instances of Traefik within your environment. Verify which of these instances have the digestAuth middleware enabled, as these are the ones requiring immediate attention. Once identified, evaluate the criticality of the routes they protect to prioritize your response, and coordinate with your platform or infrastructure teams to update to version 2.11.55 or later to resolve the underlying authentication logic error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.