Traefik versions before v2.11.55 and v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials, thereby bypassing authentication for any route protected by digestAuth without a username or password.

The vulnerability affects Traefik software from the vendor traefik, specifically all releases prior to version v2.11.55 and versions v3.0.0 through v3.7.10. Any deployment of these earlier releases using the digestAuth middleware is susceptible.

The CVSS score of 9.3 indicates a high severity of potential impact. Exploitation does not require elevated privileges or special network standing; an attacker able to send HTTP requests to a protected route can calculate a valid digest header using the empty secret and succeed in authenticating without credentials. The EPSS score of 2% suggests a low but non-zero likelihood that this vulnerability will be exploited in the wild, and the lack of KEV listing indicates no confirmed exploit data yet. Because the high severity combined with the EPSS estimate warrants action, the vulnerability remains a significant risk even without confirmed attacks.