CVE-2026-44774

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

• CWE-284
• CWE-15

• https://github.com/traefik/traefik/releases/tag/v2.11.46Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.6.17Product, Release Notes
• https://github.com/traefik/traefik/releases/tag/v3.7.1Product, Release Notes
• https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjcExploit, Patch, Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36820
• https://access.redhat.com/security/cve/CVE-2026-44774
• https://bugzilla.redhat.com/show_bug.cgi?id=2477937
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44774.json

Published

May 15, 2026

Last Modified

Jul 15, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44767setThemeRoot() failed to enforce the sap-allowed-theme-origi…6.1
• CVE-2026-44768SAP CRM WebClient UI allows an attacker to inject and execut…4.1
• CVE-2026-44769SAP S/4HANA application Project Management (PPM-PRO) allows …5.5
• CVE-2026-4477A vulnerability was determined in Yi Technology YI Home Came…3.1
• CVE-2026-44770SAP Create Single Payment does not perform necessary authori…4.3
• CVE-2026-44771SAP S/4HANA Draft operation does not perform necessary autho…4.3
• CVE-2026-44775Kavita is a cross platform reading server. Prior to 0.9.0, t…6.9
• CVE-2026-44776Kavita is a cross platform reading server. Prior to 0.9.0, t…5.9
• CVE-2026-44777jq is a command-line JSON processor. In 1.8.2rc1 and earlier…5.5
• CVE-2026-44778Inspektor Gadget is a set of tools and framework for data co…2.9
• CVE-2026-44779Discourse is an open-source discussion platform. From versio…4.3
• CVE-2026-4478A vulnerability was identified in Yi Technology YI Home Came…8.2