Traefik versions before 2.11.55 have a flaw in the digestAuth middleware that causes any username not present in the credential database to be treated as having an empty secret. An attacker can compute a valid digest response using that empty secret and arbitrary credentials, thereby bypassing authentication for any route protected by digestAuth without knowing a valid username or password.

The vulnerability affects Traefik software from the vendor traefik, specifically all releases prior to version 2.11.55. Any deployment of these earlier releases using the digestAuth middleware is susceptible.

The CVSS score of 9.3 indicates a high severity of potential impact. Exploitation does not require elevated privileges or special network standing; an attacker able to send HTTP requests to a protected route can calculate a valid digest header using the empty secret and succeed in authenticating without credentials. Because no exploit data is available and the vulnerability is not listed in CISA’s KEV catalog, the probability of exploitation remains unknown, but the high severity warrants prompt action.