GO-2026-5277 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false in github.com/traefik/traefik

🗓️ 25 Jun 2026 18:43:15Reported by GoogleType

osv🔗 osv.dev👁 2 Views

Traefik Gateway API TraefikService backend accepts rest@internal, exposing REST provider despite insecure setting.

Reporter	Title	Published	Views	Family All 26
FreeBSD	traefik -- Unauthorized exposure of the REST provider	15 May 202600:00	–	freebsd
ATTACKERKB	CVE-2026-44774	15 May 202616:30	–	attackerkb
Circl	CVE-2026-44774	11 May 202615:10	–	circl
CNNVD	Traefik 访问控制错误漏洞	15 May 202600:00	–	cnnvd
CVE	CVE-2026-44774	15 May 202616:30	–	cve
Cvelist	CVE-2026-44774 Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false	15 May 202616:30	–	cvelist
EUVD	EUVD-2026-30566	15 May 202616:30	–	euvd
Tenable Nessus	FreeBSD : traefik -- Unauthorized exposure of the REST provider (4e221ca1-573a-11f1-9f6d-5404a68ad561)	26 May 202600:00	–	nessus
Tenable Nessus	Traefik 2.x < 2.11.46 / 3.x < 3.6.17 / 3.7.x < 3.7.1 Authentication Bypass (CVE-2026-44774)	15 May 202600:00	–	nessus
Github Security Blog	Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false	13 May 202615:29	–	github

Source	Link
github	www.github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44774
github	www.github.com/traefik/traefik/releases/tag/v2.11.46
github	www.github.com/traefik/traefik/releases/tag/v3.6.17
github	www.github.com/traefik/traefik/releases/tag/v3.7.1

25 Jun 2026 19:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.18.3 - 9.9

CVSS 46.4

EPSS0.00457

SSVC