Is CVE-2026-44774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44774 being exploited in the wild.

How severe is CVE-2026-44774?

Medium severity, with a CVSS score of 4, published 15 May 2026.

Which products and versions are affected?

github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.46; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.17,introduced=3.7.0,fixed=3.7.1, SEMVER:introduced=3.7.0,fixed=3.7.1; Traefik Labs Traefik Proxy <= 2.11.45, <= 3.6.16, <= 3.7.0, <= v2.11.45, <= v3.6.16, <= v3.7.0.

Is there a fix for CVE-2026-44774?

Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.46 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44774 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44774?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44774: Traefik unauthorized REST provider exposure in Kubernetes Gateway API

Q: Is there a fix for CVE-2026-44774?

Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.46 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44774 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44774?

Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44774 · Severity: medium · CVSS 4 · Published 2026-05-15

Traefik is a popular open-source tool used to manage and route web traffic into applications. A security flaw in its Kubernetes Gateway integration allows users with limited permissions to bypass security settings and gain control over the system's configuration. An attacker could use this to reroute traffic, intercept data, or cause a service outage by modifying how the proxy handles requests.

Technologies: github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go), Traefik Labs Traefik Proxy. Vendors: Go, Traefik Labs.

Quick answers

Is CVE-2026-44774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44774 being exploited in the wild.
How severe is CVE-2026-44774?: Medium severity, with a CVSS score of 4, published 15 May 2026.
Which products and versions are affected?: github.com/traefik/traefik (Go) SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.34; github.com/traefik/traefik/v2 (Go) SEMVER:introduced=0,fixed=2.11.46; github.com/traefik/traefik/v3 (Go) SEMVER:introduced=0,fixed=3.6.17,introduced=3.7.0,fixed=3.7.1, SEMVER:introduced=3.7.0,fixed=3.7.1; Traefik Labs Traefik Proxy <= 2.11.45, <= 3.6.16, <= 3.7.0, <= v2.11.45, <= v3.6.16, <= v3.7.0.
Is there a fix for CVE-2026-44774?: Yes. github.com/traefik/traefik/v2 (Go): upgrade to 2.11.46 or later; github.com/traefik/traefik/v3 (Go): upgrade to 3.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44774 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44774?: Check whether you run github.com/traefik/traefik (Go), github.com/traefik/traefik/v2 (Go), github.com/traefik/traefik/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/traefik/traefik/v2 (Go): upgrade to 2.11.46 or later
```
go get github.com/traefik/traefik/v2@v2.11.46
```
github.com/traefik/traefik/v3 (Go): upgrade to 3.7.1 or later
```
go get github.com/traefik/traefik/v3@v3.7.1
```

Technical details

An improper access control vulnerability exists in Traefik's Kubernetes Gateway API provider. The provider's 'isInternalService' check broadly accepts any TraefikService backend reference ending in '@internal', including 'rest@internal'. This allows an attacker with HTTPRoute creation permissions to bypass the 'providers.rest.insecure=false' setting, which is intended to prevent the REST handler from being exposed. By routing traffic to 'rest@internal', a low-privileged actor can gain write access to Traefik's dynamic configuration via the REST API, leading to unauthorized reconfiguration of routers and services. The issue is fixed in versions 2.11.46, 3.6.17, and 3.7.1.

Affected products

Traefik Traefik <= 2.11.45, <= 3.6.16, <= 3.7.0

Identifiers

CVE-2026-44774
GHSA-96qj-4jj5-wcjc
GO-2026-5277

Timeline

2026-05-11: patched: Versions 2.11.46, 3.6.17, and 3.7.1 released
2026-05-11: advisory: GitHub Security Advisory GHSA-96qj-4jj5-wcjc published
2026-05-15: disclosed: CVE-2026-44774 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.