Executive brief
Traefik is a popular open-source tool used to manage and route web traffic into applications. A security flaw in its Kubernetes Gateway integration allows users with limited permissions to bypass security settings and gain control over the system's configuration. An attacker could use this to reroute traffic, intercept data, or cause a service outage by modifying how the proxy handles requests.
Technical details
An improper access control vulnerability exists in Traefik's Kubernetes Gateway API provider. The provider's 'isInternalService' check broadly accepts any TraefikService backend reference ending in '@internal', including 'rest@internal'. This allows an attacker with HTTPRoute creation permissions to bypass the 'providers.rest.insecure=false' setting, which is intended to prevent the REST handler from being exposed. By routing traffic to 'rest@internal', a low-privileged actor can gain write access to Traefik's dynamic configuration via the REST API, leading to unauthorized reconfiguration of routers and services. The issue is fixed in versions 2.11.46, 3.6.17, and 3.7.1.
Affected products
- Traefik Traefik <= 2.11.45, <= 3.6.16, <= 3.7.0
Timeline
- 2026-05-11: patched: Versions 2.11.46, 3.6.17, and 3.7.1 released
- 2026-05-11: advisory: GitHub Security Advisory GHSA-96qj-4jj5-wcjc published
- 2026-05-15: disclosed: CVE-2026-44774 published to NVD