PT-2026-40716 · Traefik · Traefik

Published

2026-05-13

·

Updated

2026-05-19

·

CVE-2026-44774

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.11.46 Traefik versions prior to 3.6.17 Traefik versions prior to 3.7.1
Description Traefik's Kubernetes Gateway API provider contains an authorization bypass that allows a tenant with HTTPRoute creation permissions to expose the REST provider handler. This occurs because the Gateway provider accepts any TraefikService backend reference ending with @internal, enabling traffic to be routed to rest@internal instead of only the intended api@internal. In shared Gateway deployments where the REST provider is enabled, a low-privileged actor can bypass the providers.rest.insecure=false setting to gain live dynamic configuration write access via the 'PUT /api/providers/rest' endpoint. This access allows for the unauthorized reconfiguration of routers and services.
Recommendations Update to version 2.11.46. Update to version 3.6.17. Update to version 3.7.1.

Fix

Improper Access Control

Weakness Enumeration

Related Identifiers

CVE-2026-44774
GHSA-96QJ-4JJ5-WCJC
OPENSUSE-SU-2026:10810-1
OPENSUSE-SU-2026:10811-1

Affected Products

Traefik