Traefik 2.x < 2.11.46 / 3.x < 3.6.17 / 3.7.x < 3.7.1 Authentication Bypass (CVE-2026-44774)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(314905);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/20");

  script_cve_id("CVE-2026-44774");
  script_xref(name:"IAVB", value:"2026-B-0127");

  script_name(english:"Traefik 2.x < 2.11.46 / 3.x < 3.6.17 / 3.7.x < 3.7.1 Authentication Bypass (CVE-2026-44774)");

  script_set_attribute(attribute:"synopsis", value:
"The remote macOS host is affected by an authentication bypass vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Traefik installed on the remote macOS host is 2.x prior to 2.11.46, 3.x prior to 3.6.17, or 3.7.x
prior to 3.7.1. It is, therefore, affected by an authentication bypass vulnerability:

  - The Kubernetes Gateway API provider accepts any TraefikService backend reference whose name ends with @internal,
    allowing exposure of the rest@internal handler and bypassing the providers.rest.insecure=false setting.
    (CVE-2026-44774)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4cb940a2");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Traefik version 2.11.46, 3.6.17, 3.7.1, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44774");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:traefik:traefik");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macos_traefik_installed.nbin");
  script_require_keys("Host/local_checks_enabled", "installed_sw/traefik");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {
      'scope': 'target',
      'match': {'os': 'macos'}
    }
  ],
  'checks': [
    {
      'product': {'name': 'traefik', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '2.0.0', 'fixed_version': '2.11.46'},
        {'min_version': '3.0.0', 'fixed_version': '3.6.17'},
        {'min_version': '3.7.0', 'fixed_version': '3.7.1'}
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);