Kubernetes Gateway API Vulnerability in Traefik by Traefik Labs
CVE-2026-44774
6.4MEDIUM
What is CVE-2026-44774?
A flaw exists in Traefik's Kubernetes Gateway API provider that allows a low-privileged actor to expose the REST provider handler, despite settings designed to prevent this exposure. Specifically, the Gateway provider permits the use of backend references that could unintentionally route traffic to internal services. This vulnerability could lead to unauthorized dynamic configuration write access, enabling attackers to reconfigure routers and services irresponsibly. Users should upgrade to Traefik versions 2.11.46, 3.6.17, or 3.7.1 to mitigate this risk.
Affected Version(s)
traefik < 2.11.46 < 2.11.46
traefik >= 3.0.0-beta1, < 3.6.17 < 3.0.0-beta1, 3.6.17
traefik >= 3.7.0-rc.0, < 3.7.1 < 3.7.0-rc.0, 3.7.1