Traefik EUVD-2026-71018

Requires that the target route be protected by Traefik's digestAuth middleware on a version before v2.11.55; the attacker then supplies any username that does not exist in the configured user store, which triggers the empty-secret code path. No valid username, no valid password, no authentication, and no user interaction are required - the only limiting factors are that digest (not basic/forward) auth must be in use and the endpoint must be network-reachable to the attacker.

This is a genuine high-priority issue, not an inflated CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) is consistent with the description: exploitation is fully network-reachable, requires no privileges or user interaction, and is low-complexity because the attacker only needs to submit any unknown username and perform standard digest computation with an empty secret. The high VC/VI/VA impacts reflect that bypassing perimeter auth exposes whatever the protected backend offers. No EPSS score, KEV listing, or POC was provided in the input, so exploitation is currently theoretical-but-trivial rather than confirmed in the wild. The main real-world limiter is scope: only deployments that actually use the digestAuth middleware are affected - basicAuth, forwardAuth, or unauthenticated routes are not - so blast radius depends on how many operators rely on digest auth. There are no conflicting signals between the CVSS vector and the description.

An attacker discovers a Traefik-fronted admin panel or API guarded by digest authentication. They send a request with a made-up username, receive the server's WWW-Authenticate challenge, and compute the digest response using an empty secret and any password - the values the vulnerable server also derives - gaining access with no valid credentials. Because attack complexity is low and no interaction is needed, this can be scripted broadly against exposed Traefik instances even though no public POC is currently confirmed.