Log in Start free

Vulnerability · Published May 15, 2026 · Assigned by GitHub_M

CVE-2026-44774Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

High 8.3

In plain English

A high-severity improper access control in traefik from traefik. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/traefik/traefikno fix listedGHSA-96qj-4jj5-wcjc
Gogithub.com/traefik/traefikno fix listedGO-2026-5277
Gogithub.com/traefik/traefik/v22.11.46GHSA-96qj-4jj5-wcjc
Gogithub.com/traefik/traefik/v22.11.46GO-2026-5277
Gogithub.com/traefik/traefik/v33.7.1GHSA-96qj-4jj5-wcjc
Gogithub.com/traefik/traefik/v33.6.17, 3.7.1GO-2026-5277
Gogithub.com/traefik/traefik/v33.6.17GHSA-96qj-4jj5-wcjc

Affected products (as reported)

VendorProductVersions
traefik traefik < 2.11.46>= 3.0.0-beta1, < 3.6.17>= 3.7.0-rc.0, < 3.7.1

Weakness: CWE-284, CWE-15 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

References