6.4
Medium
CVE-2026-44774 Traefik is an HTTP reverse proxy and load balancer
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| traefik 3.7 | 3.7.0-rc.0 → < 3.7.1 | 3.7.1 |
| traefik 3.0 | 3.0.0-beta1 → < 3.6.17 | 3.6.17 |
| traefik 2.11 | earliest → < 2.11.46 | 2.11.46 |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift Dev Spaces 3.29 1782403274 | earliest → < 1782403274 | 1782403274 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of traefik
The 80 CVEs of traefik →
CVE-2026-121966
Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak
7.0
High
CVE-2026-119574
Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…
8.2
High
CVE-2026-119573
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…
2.1
Low
CVE-2026-119572
Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
7.0
High