access.redhat.comVendor advisory
https://access.redhat.com/errata/RHSA-2026:36820 CVE-2026-44774
MEDIUM
Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false
Record summary
CVE-2026-44774 has a selected CVSS score of 6.4 (medium).
Description
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 16, 2026 · Source: CVE List
Affected products and versions
7| Product | Source | Version range | Status |
|---|---|---|---|
Red Hat OpenShift Dev Spaces 3.29Browse Red Hat / Red Hat OpenShift Dev Spaces 3.29devspaces/traefik-rhel9Default status: affected | CVE List | 1782403274 to < * | unaffected |
Red Hat OpenShift GitOpsBrowse Red Hat / Red Hat OpenShift GitOpsopenshift-gitops-1/argo-rollouts-rhel8Default status: unaffected | CVE List | Version data not supplied | |
Red Hat OpenShift GitOpsBrowse Red Hat / Red Hat OpenShift GitOpsopenshift-gitops-1/argo-rollouts-rhel9Default status: unaffected | CVE List | Version data not supplied | |
traefikBrowse traefik / traefik | CVE List | < 2.11.46 | affected |
| >= 3.0.0-beta1, < 3.6.17 | affected | ||
| >= 3.7.0-rc.0, < 3.7.1 | affected | ||
github.com/traefik/traefikBrowse Go / github.com/traefik/traefik | GitHub Advisory | Through 1.7.34 | affected |
github.com/traefik/traefik/v2Browse Go / github.com/traefik/traefik/v2 | GitHub Advisory | Before 2.11.46 · Fixed in 2.11.46 | affected |
github.com/traefik/traefik/v3Browse Go / github.com/traefik/traefik/v3 | GitHub Advisory | 3.7.0 | affected |
| 3.7.0 to < 3.7.1 · Fixed in 3.7.1 | affected | ||
| Before 3.6.17 · Fixed in 3.6.17 | affected | ||
References
10access.redhat.comvdb entry
https://access.redhat.com/security/cve/CVE-2026-44774 RHBZ#2477937issue tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2477937 github.com
https://github.com/traefik/traefik github.com
https://github.com/traefik/traefik/releases/tag/v2.11.46 github.com
https://github.com/traefik/traefik/releases/tag/v3.6.17 github.com
https://github.com/traefik/traefik/releases/tag/v3.7.1 github.comConfirmation
https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-44774 security.access.redhat.comx_sadp csaf vex
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44774.json