Threat Intelligence Report: CVE-2026-85595

Executive Summary

CVE-2026-85595 is an authentication bypass vulnerability in the digestAuth middleware of Traefik versions prior to v2.11.55. The flaw resides in how the middleware handles digest authentication for unknown usernames — instead of rejecting the authentication attempt outright, Traefik assigns an empty secret to unrecognized usernames. This allows an unauthenticated remote attacker to compute a valid digest response using the empty secret (a known, zero-length value) along with arbitrary credentials, thereby gaining access to any route protected by digestAuth without possessing a valid username or password. Any organization running Traefik as a reverse proxy or edge router with digestAuth-protected routes is affected and should treat this as a high-priority exposure until a fix is confirmed and deployed.

Technical Analysis

Vulnerability Mechanism

Traefik's digestAuth middleware implements HTTP Digest Access Authentication (RFC 7616) to protect routes. In a correct implementation, when a client presents credentials for an unknown username, the server should return a 401 Unauthorized response. However, in vulnerable versions before v2.11.55, the middleware's credential lookup logic fails to differentiate between a user that exists with an empty password versus a user that does not exist at all. The result is that unknown usernames are internally assigned an empty secret (length-zero string) rather than being rejected.

Attack Surface

The attack surface is any HTTP route protected by the digestAuth middleware in a vulnerable Traefik deployment. This includes:

• API endpoints exposed through Traefik as an edge router
• Internal services fronted by Traefik in microservice architectures
• Admin panels, dashboards, or operational interfaces using digest protection

The vulnerability is remotely exploitable without authentication. No physical access, prior knowledge of valid credentials, or special privileges are required. The only precondition is network reachability to a digestAuth-protected route.

Technical Details from the Description

Per the NVD description: "Traefik versions before v2.11.55 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password."

The core logic flaw is in the username-to-secret resolution. The digest authentication protocol requires both client and server to compute a response hash based on a shared secret. When the server-side lookup for a username returns an empty secret instead of a "user not found" state, the server proceeds with the digest computation using that empty secret. An attacker who knows the empty secret and can observe the server's nonce (typically sent in the initial 401 challenge) can compute the correct digest response offline for any chosen username.

CVSS Assessment

The NVD has not assigned a CVSS score or vector string to this vulnerability at the time of this writing. While a formal score is pending, the characteristics of this vulnerability — network-reachable attack vector, no privileges required, no user interaction needed, and a direct authentication bypass — suggest that when scored, the CVSS v3.x base score will likely land in the High to Critical range (7.5–9.8). Analysts should monitor NVD for the formal score assignment.

Exploitation Scenarios

Note: No public PoC or exploit code exists for this vulnerability at the time of writing. The attack chain below is inferred from the vulnerability class (authentication bypass via known-secret arithmetic) and the NVD description.

Step 1: Reconnaissance / Target Identification

The attacker first identifies Traefik instances exposing digestAuth-protected routes. Reconnaissance techniques include:

• Shodan/Censys scans for product:Traefik or HTTP response headers like Server: Traefik
• HTTP probing of known admin paths, API gateways, or internal tooling that commonly uses digest authentication
• Observing the WWW-Authenticate response header on protected routes — a Digest scheme challenge tells the attacker that digestAuth is enforced

Step 2: Triggering the Flaw

The attacker sends a request to a protected route with any arbitrary username that does not exist in the middleware's user store. The server responds with a 401 Unauthorized challenge containing a WWW-Authenticate: Digest header. This header includes the realm, a nonce (server-generated random value), and an algorithm directive (e.g., MD5). The attacker now has the challenge parameters needed to compute a valid digest response.

Step 3: Payload / Exploitation Method

At the vulnerability-class level, the attacker computes a valid digest response as follows:

1. Select arbitrary credentials. The attacker chooses any username (e.g., admin, nonexistent_user, or any string) and any password — both values are irrelevant because the server will use the empty secret for the digest computation.
2. Use the empty secret as the password. The attacker computes HA1 = MD5(username:realm:empty_secret).
3. Compute the full digest. The attacker obtains the nonce from the server's 401 challenge and computes HA2 = MD5(method:uri) and the final response MD5(HA1:nonce:HA2).
4. Send the crafted Authorization header. The attacker replays the original request with an Authorization: Digest header containing the computed response and the arbitrary username.

The vulnerable server looks up the arbitrary username, fails to find it, assigns the empty secret (instead of rejecting), computes the expected digest using that empty secret, and compares it to the attacker's submitted digest. Since both sides used the same empty secret, the values match, and authentication succeeds.

Step 4: Post-Exploitation Impact

Upon successful authentication bypass, the attacker gains full access to the protected route(s), including:

• Access to sensitive application data, configuration files, or administrative functions served behind the digestAuth middleware
• Potential lateral movement into backend services if the protected route proxies to internal applications
• Data exfiltration, service disruption, or further exploitation of backend components, depending on what the protected route exposes

For example, if an organization uses Traefik to protect a Kubernetes dashboard, database admin interface, or CI/CD pipeline console with digestAuth, the attacker gains full control of that service.

Impact Assessment

Business Impact

The impact of CVE-2026-85595 is an authentication boundary failure. Successfully exploited, it allows a remote, unauthenticated actor to access any HTTP resource that relies on Traefik's digestAuth middleware for access control. This collapses the security control to zero — the middleware provides no protection whatsoever on affected routes.

The severity of business impact depends entirely on what the digestAuth middleware protects:

• If it protects an administrative dashboard or configuration interface, the attacker gains management-level access
• If it protects an API gateway for backend microservices, the attacker can invoke backend APIs without authorization
• If it protects regulatory-relevant systems (PCI, HIPAA, GDPR), the breach may trigger notification obligations

Affected Systems

• All Traefik deployments running versions prior to v2.11.55 are vulnerable
• Only deployments using the digestAuth middleware are affected — deployments using basicAuth or other authentication methods are not impacted by this specific flaw
• Both open-source Traefik and Traefik Enterprise (if it uses the same core middleware) may be affected; organizations should verify against the v2.11.55 release notes

Blast Radius

The blast radius is network-wide for any organization that exposes digestAuth-protected routes to untrusted networks (e.g., the internet). Since Traefik commonly operates as an edge router, the compromise of middleware authentication typically exposes backend services to direct attacker access.

CISA KEV Status

CISA KEV: NO — this vulnerability does not appear on the Known Exploited Vulnerabilities catalog at the time of writing. However, this status can change quickly; security teams should monitor the KEV catalog.

Detection Guidance

Sigma Rule

title: Traefik DigestAuth Authentication Bypass Attempt (CVE-2026-85595)
id: 0e8b7e0e-6f5f-4d3c-9a1b-2f8d5a6e3c90
status: experimental
description: Detects successful authentication to digestAuth-protected Traefik routes using unusual or unmapped usernames, potentially indicating CVE-2026-85595 exploitation.
author: Valtersit Threat Intel
date: 2026/05/15
logsource:
  category: webserver
  product: traefik
detection:
  selection:
    http.response.status_code: 200
    application: traefik
  filter_auth_success:
    http.user_agent: null  # UAs are not relevant
  filter_known_routes:
    http.url|startswith:
      - '/public/'
      - '/healthz'
  condition: selection and not filter_known_routes
  timeframe: 1h
level: high
fields:
  - client.ip
  - http.url
  - http.username
falsepositives:
  - Legitimate automation accounts with usernames not present in the digestAuth user store
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.85595

YARA Rule

rule Detect_Traefik_DigestAuth_Bypass_CVE_2026_85595
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTTP Authorization Digest headers that may indicate exploitation of Traefik digestAuth bypass CVE-2026-85595"
        cve = "CVE-2026-85595"
        date = "2026-05-15"
        severity = "high"

    strings:
        // Digest auth header pattern with unused/suspicious usernames
        $auth_header = /Authorization:\s*Digest\s+username\s*=\s*"(?!valid_user)[a-zA-Z0-9_-]+"/
        $nonce_field = "nonce="
        $uri_field = "uri="
        
        // Response computation markers often present in exploitation scripts
        $md5_lookup = "md5(" ascii nocase
        $ha1_calc = "ha1" ascii nocase
        $empty_secret = "H(empty)" ascii nocase

    condition:
        uint16(0) == 0x0d0a and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Traefik DigestAuth Authentication Bypass Attempt (CVE-2026-85595)"; flow:to_server,established; content:"Authorization|3A| Digest"; http_header_names; content:"username"; http_header_names; nocase; pcre:"/Authorization:\s*Digest\s+username\s*=\s*\"(?!valid_user)[^\"]+\"/i"; sid:2026085595; rev:1; metadata:created_at 2026_05_15, updated_at 2026_05_15, cve CVE-2026-85595; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-85595; classtype:attempted-admin;)

Elastic Detection

// EQL: Detect successful responses to digestAuth-protected routes with unknown usernames
sequence by source.ip
  with maxspan=1m
  [ http where http.request.method == "GET" and 
    http.response.status_code == 401 and
    url.original != null ]
  [ http where http.response.status_code == 200 and
    url.original != null and
    http.request.headers.authorization != null ]

Splunk SPL Query

index=proxy OR index=traefik sourcetype="traefik:access"
| spath input=_raw
| search status=200
| regex _raw="Authorization: Digest"
| regex _raw="username=\"(?!valid_user)[^\"]+\""
| where NOT uri LIKE "/public/%" AND NOT uri LIKE "/healthz"
| stats count by src_ip, uri, username
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="traefik,authentication_bypass,">
  <rule id="353634" level="15">
    <decoded_as>json</decoded_as>
    <field name="status">200</field>
    <field name="auth_type">digest</field>
    <description>Traefik digestAuth authentication bypass detected - CVE-2026-85595</description>
    <group>authentication_bypass,traefik,attack.initial_access,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-85595</info>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source has been identified at the time of writing. The affected version boundary is stated as "before v2.11.55," which implies that v2.11.55 is the intended fix release — however, this version has not been independently confirmed as released or patched by any tracked vendor channel.

Immediate Mitigations (until a patch is deployed)

1. Disable digestAuth middleware on all routes where possible. Replace with a stronger authentication mechanism, such as basicAuth with HTTPS, forwardAuth against an OIDC/OAuth2 provider, or mTLS client certificates.
2. Apply network-level access controls. If digestAuth-protected routes cannot be removed, restrict source IPs via firewall or Traefik's ipWhiteList middleware to only known administrative networks. This reduces the attack surface from the entire internet to trusted segments.
3. Enable robust access logging and monitor for successful 200 responses to digestAuth-protected routes from unknown IPs or with unusual username values.
4. Place Traefik behind a WAF that can inspect and block suspicious Authorization header patterns.

Patch / Upgrade Steps

1. Monitor Traefik official release announcements (GitHub releases, mailing lists, security advisories) for confirmation of v2.11.55 or a later patched version.
2. When the patched version is confirmed available, upgrade via your deployment method:
   • Docker: Update the image tag and recreate containers
   • Kubernetes: Update Helm chart values or image tag, then roll out
   • Binary/source: Replace the binary with the fixed version
3. Verify the fix: test that digestAuth now returns 401 Unauthorized for unknown usernames rather than granting access.
4. Validate all existing middleware configurations after the upgrade.

Long-Term Hardening

1. Adopt forwardAuth or OAuth2 proxy patterns for production authentication needs rather than HTTP-level digest/basic auth, which are legacy protocols with limited security properties.
2. Ensure TLS termination at Traefik (or earlier) so that authentication headers are never transmitted in plaintext.
3. Regularly inventory all authentication middleware configurations in your Traefik deployments and audit for legacy auth mechanisms.
4. Subscribe to Traefik security advisories to receive early notice of future vulnerabilities.
5. Segment networks so that reverse proxies do not directly expose sensitive backend services; use a service mesh or internal network policies as a defense-in-depth layer.

References

1. NVD Vulnerability Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-85595
2. CWE-287 Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
3. Traefik Official Website (monitor for security advisories): https://traefik.io/
4. Traefik GitHub Releases (monitor for patched version): https://github.com/traefik/traefik/releases
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor Campaigns / In-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-85595 at the time of this writing. The vulnerability has not been added to CISA KEV. However, given the relative ease of exploitation (publicly known empty-secret arithmetic) and the prevalence of Traefik in production environments, active exploitation should be considered likely once the vulnerability is widely disclosed. Security teams are strongly encouraged to apply mitigations proactively rather than waiting for observed exploitation.

Report generated for valtersit.com by the Valtersit Threat Intelligence team. This document is intended for use by authorized security personnel. All information is derived from the CVE data provided and public references cited above.