CVE-2026-85595

Katalog CVE

CVSS 9.8 · Critical EPSS 0,69%

Kerentanan Improper Authentication pada traefik. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials to bypass authentication on any digestAuth-protected route without a valid username or password.

Rincian

Terbit di NVD

4 September 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/traefik/traefik/security/advisories/GHSA-5w68-77r2-r64c exploit · mitigasi · patch · advisory vendor
• https://www.vulncheck.com/advisories/traefik-before-2.11.55-authentication-bypass-via-digestauth advisory pihak ketiga