critical CVSS 9.9 EPSS 0.55%

CVE-2026-44774·Traefik vulnerability

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

Severity
critical
Software
Traefik
Fixed in
3.7.1
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.55% — higher than 44% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-44774 scores 9.9 on CVSS, so a successful attack would be serious — but at 0.55%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 3.7.0

Until: 3.7.1

Fixed in: 3.7.1

How to fix this CVE

Upgrade Traefik to version 3.7.1 or later to patch the Kubernetes Gateway API provider vulnerability. This update restricts unauthorized access to the REST provider handler and prevents low-privileged users from bypassing security settings. Verify the upgrade by checking the version output and reviewing your HTTPRoute configurations to ensure no unintended @internal service references exist.

sudo dnf update traefik-3.7.1

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|PUT|DELETE /api/routers|/api/services matching patterns like 'rest@internal' or '@internal' in the request body or path, combined with X-Forwarded-For headers or ServiceAccount tokens from non-admin users in Kubernetes audit logs

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement a WAF rule to block any HTTP requests to Traefik's REST API endpoint (/api/*) originating from non-admin source IPs or lacking valid Traefik admin credentials. Rate-limit HTTPRoute creation requests in your Kubernetes ingress controller and monitor for suspicious TraefikService backend references containing '@internal'.

How to check if you are affected

  1. Step 1: Check installed Traefik version by running: traefik version or check your deployment with kubectl get deployment traefik -o jsonpath='{.spec.template.spec.containers[0].image}'
  2. Step 2: Verify REST provider is enabled in your Traefik config: grep -r 'rest:' /etc/traefik/ or check your Helm values for providers.rest settings
  3. Step 3: Search logs for unexpected HTTPRoute creations targeting @internal services: grep -i 'rest@internal\|api@internal' /var/log/traefik/access.log
  4. Step 4: Confirm the patch by running traefik version and verifying the output shows 3.7.1 or higher

Indicators of compromise

  • HTTPRoute resources with spec.rules[*].backendRefs[*].name matching '.*@internal'
  • Traefik API calls to /api/routers or /api/services from ServiceAccounts with only HTTPRoute creation permissions
  • Requests to rest@internal or api@internal endpoints from non-localhost origins in Traefik access logs

FAQ

What is CVE-2026-44774?

This is a privilege escalation vulnerability in Traefik's Kubernetes Gateway API provider where low-privileged users who can create HTTPRoutes can exploit a logic flaw to route traffic to the REST provider endpoint, gaining unauthorized configuration write access to the entire Traefik instance.

Is CVE-2026-44774 being actively exploited?

According to CISA, this vulnerability is not currently listed in the Known Exploited Vulnerabilities (KEV) catalog, and no public exploits are available. However, the attack is straightforward and organizations should prioritize patching in multi-tenant Kubernetes environments.

What versions of Traefik are affected by CVE-2026-44774?

Traefik versions 3.7.0 through 3.7.0 are affected. Earlier branches (2.11.x and 3.6.x) also have vulnerable versions—2.11.45 and earlier, 3.6.16 and earlier.

How do I check if my server is vulnerable to CVE-2026-44774?

Run 'traefik version' to check your installed version. If it shows 3.7.0 or earlier (for the 3.7 branch), you are vulnerable. Additionally, inspect your Traefik configuration with 'grep providers.rest /etc/traefik/traefik.yaml' to confirm if the REST provider is enabled.

Does Defensia detect CVE-2026-44774?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Traefik is installed on a monitored server, CVE-2026-44774 will appear in your dashboard with remediation steps.

Related Traefik CVEs

CVE-2026-48491CVSS 10Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard host rule such as Host(*.example.com) with stricter TLS options (for example RequireAndVerifyClientCert), SNICheck resolves the TLS options for the HTTP Host header using exact map lookups only and never applies wildcard matching. If another permissive SNI is served on the same entrypoint, an attacker can complete the TLS handshake under the permissive options and then send an HTTP Host header targeting the wildcard-protected backend, reaching it without presenting a client certificate. This affects the regular HTTPS / HTTP-2 path and does not require HTTP/3. This vulnerability is fixed in 3.7.3.
CVE-2026-54763CVSS 10Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which many backends normalize identically to dashed forms. An attacker able to reach a protected route can inject an underscore-variant header that survives Traefik's stripping and reaches the backend alongside, or on the unauthenticated ForwardAuth authResponseHeaders path instead of, the value Traefik intended to set, spoofing identity or authorization context. This issue is fixed in versions v2.11.51, v3.6.22, and v3.7.6.
CVE-2026-53622CVSS 10Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. The issue affects deployments where HTTP/3 is enabled, a router uses a wildcard Host rule or case-insensitive hostname matching, a router-specific TLSOptions enforces client certificate authentication, and UDP access to the entrypoint is reachable by an attacker. This vulnerability is fixed in versions 3.7.3, 3.6.18, and 2.11.51.
CVE-2026-48020CVSS 10Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass route-level authentication and authorization. When a public router matches on a PathPrefix rule and applies the StripPrefix middleware, a request path containing .. or its percent-encoded form %2e%2e can match the public route at routing time and then, after the prefix is stripped and the path is normalized, resolve to a path served by a separate, authenticated router. As a result, an attacker can reach protected backend paths — such as admin or internal configuration endpoints — without satisfying the authentication middleware attached to the protected router. This vulnerability is fixed in 2.11.48, 3.6.19, and 3.7.3.
CVE-2026-88877CVSS 9.8Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creates an additional 'sibling' router that matches on the host alone, carries only the RedirectRegex middleware, and still points at the parent router's protected backend service. Because RedirectRegex is not a terminal handler, a request its pattern does not match is forwarded to the backend, and because the redirect pattern only accepts a numeric port while Traefik's host matcher canonicalizes the authority via net.SplitHostPort, a request with a non-numeric or empty port (for example 'Host: www.example.com:x') selects the sibling router, misses the redirect, and is proxied to the protected backend with none of the Ingress's annotation-derived middlewares applied. This discards not only authentication (e.g. BasicAuth) but every annotation-derived middleware, including source-IP allowlisting. Traefik v2 and v3 releases before v3.7.0 are not affected. The issue is fixed in v3.7.12.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-44774. Free for 1 server.

Get started free