CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false

🗓️ 15 May 2026 16:30:43Reported by GoogleType

osv🔗 osv.dev👁 1 Views

CVE-2026-44774: Traefik Gateway API exposes rest@internal via backends ending with @internal, bypassing rest.insecure.

Reporter	Title	Published	Views	Family All 28
FreeBSD	traefik -- Unauthorized exposure of the REST provider	15 May 202600:00	–	freebsd
ATTACKERKB	CVE-2026-44774	15 May 202616:30	–	attackerkb
Circl	CVE-2026-44774	11 May 202615:10	–	circl
CNNVD	Traefik 访问控制错误漏洞	15 May 202600:00	–	cnnvd
CVE	CVE-2026-44774	15 May 202616:30	–	cve
Cvelist	CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false	15 May 202616:30	–	cvelist
EUVD	EUVD-2026-30566	15 May 202616:30	–	euvd
Tenable Nessus	FreeBSD : traefik -- Unauthorized exposure of the REST provider (4e221ca1-573a-11f1-9f6d-5404a68ad561)	26 May 202600:00	–	nessus
Tenable Nessus	Traefik 2.x < 2.11.46 / 3.x < 3.6.17 / 3.7.x < 3.7.1 Authentication Bypass (CVE-2026-44774)	15 May 202600:00	–	nessus
Github Security Blog	Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false	13 May 202615:29	–	github

Source	Link
github	www.github.com/traefik/traefik/releases/tag/v2.11.46
github	www.github.com/traefik/traefik/releases/tag/v3.6.17
github	www.github.com/traefik/traefik/releases/tag/v3.7.1
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44774.json
access	www.access.redhat.com/errata/RHSA-2026:36820
access	www.access.redhat.com/security/cve/CVE-2026-44774
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44774.json
github	www.github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44774
bugzilla	www.bugzilla.redhat.com/show_bug.cgi

11 Jul 2026 03:53Current

5.9Medium risk

Vulners AI Score5.9

CVSS 46.4

EPSS0.00468