On August 21st, the Traefik project announced a security vulnerability with a severity of 9.3/10 that allowed a “complete authentication bypass in the digestAuth middleware”.
Any unauthenticated remote client can bypass Traefik’s digestAuth middleware in two requests by supplying an unknown username, for which the vulnerable implementation used a computable empty secret.
Internet-facing routes, including dashboards and APIs, may have had no effective authentication, and require an urgent upgrade plus access-log review.
All Traefik generations shipping the middleware are affected, with fixes available in v2.11.55 and v3.7.11; older release lines will not be patched.