Cyber Resilience

CVE-2026-44774

MediumPublic PoCUpdated

Published: 15 May 2026

Published
15 May 2026
Modified
30 June 2026
KEV Added
Patch
CVSS Score v4 6.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0046 36.4th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-44774 is a medium-severity Improper Access Control (CWE-284) vulnerability in Traefik Traefik. Its CVSS base score is 6.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider…

more

accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Bypass of access control on public-facing Traefik Gateway API provider directly enables exploitation of the exposed application to gain unauthorized configuration access.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

Affected Assets

traefik
traefik
≤ 2.11.46 · 3.0.0 — 3.6.17 · 3.7.0 — 3.7.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-15 CWE-284

The policy and procedures establish internal controls and change management for system configuration settings, reducing the feasibility of external unauthorized modifications.

addresses: CWE-15 CWE-284

Baseline configuration under change control directly prevents unauthorized external modification of system or configuration settings.

addresses: CWE-15 CWE-284

Requires approval, documentation, and security impact review of all configuration changes, directly preventing unauthorized external control of system settings.

addresses: CWE-15 CWE-284

Impact analysis of configuration changes reduces the risk of deploying settings that permit unauthorized external control.

addresses: CWE-284 CWE-15

Enforcing physical and logical access restrictions for system changes directly prevents unauthorized actors from modifying the system.

addresses: CWE-15 CWE-284

Establishing, implementing, approving deviations from, and monitoring configuration settings directly prevents external or unauthorized control of system settings.

addresses: CWE-15 CWE-284

The plan defines processes for identifying and managing configuration items, preventing external unauthorized control of system settings.

addresses: CWE-15 CWE-284

Vulnerability scanners directly detect externally controllable or misconfigured settings using standardized checklists.

References