Traefik versions before v2.11.55 and v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middleware where unknown usernames receive an empty secret instead of rejection. Attackers can compute a valid digest response using the empty secret and arbitrary credentials, thereby bypassing authentication for any route protected by digestAuth without a valid username or password.

The vulnerability affects Traefik software from the vendor traefik, specifically all releases prior to version v2.11.55 and versions v3.0.0 through v3.7.10. Any deployment of these earlier releases using the digestAuth middleware is susceptible.

The CVSS score of 9.3 indicates a high severity of potential impact. Exploitation does not require elevated privileges or special network standing; an attacker able to send HTTP requests to a protected route can calculate a valid digest header using the empty secret and succeed in authenticating without credentials. Because no exploit data is available and the vulnerability is not listed in CISA’s KEV catalog, the probability of exploitation remains unknown, but the high severity warrants prompt action.