CVE-2026-85595

Red Hat statement

A flaw was found in Traefik's digestAuth middleware (versions before v2.11.55 and v3.0.0 through v3.7.10) where requests with unknown usernames are processed using an empty secret instead of being immediately rejected. Within Red Hat environments utilizing affected Traefik components, an unauthenticated remote attacker can exploit this default state by computing a valid HTTP digest response using an empty secret and arbitrary credentials, successfully bypassing authentication on any digestAuth-protected endpoint.

Red Hat mitigation

Disable the digestAuth middleware and transition to alternative authentication mechanisms such as basicAuth, ForwardAuth, or mTLS. Alternatively, restrict network access to digestAuth-protected routes at an upstream gateway or network firewall until patched.