CVE-2026-44774 is a high impact access control flaw (CVSS 9.9 in the record) in the Traefik Kubernetes Gateway API provider. A tenant who can create HTTPRoutes can expose the REST provider and rewrite routing. Upgrade to 2.11.46, 3.6.17 or 3.7.1, depending on which branch you run, and turn off the REST provider if unused.
What's affected
From the project advisory:
- Traefik v2: 2.11.45 and earlier are affected, fixed in 2.11.46.
- Traefik v3.0 to v3.6: up to 3.6.16 affected, fixed in 3.6.17.
- Traefik v3.7: 3.7.0 affected, fixed in 3.7.1.
Exposure needs all of the following: the Kubernetes Gateway API provider is enabled, the REST provider is enabled, and other parties (tenants) are allowed to create or update HTTPRoute resources in a namespace that a shared Gateway accepts. The advisory notes the project rates its own severity as medium, while the NVD record scores it 9.9. The difference comes from the conditions above. If you run a single team cluster with no REST provider, your exposure is smaller, but you should still upgrade.
How to check if you're exposed
Check your Traefik version:
kubectl get deploy -A -o jsonpath='{range .items[*]}{.metadata.namespace}{" "}{.metadata.name}{" "}{.spec.template.spec.containers[*].image}{"\n"}{end}' | grep -i traefik
Then check your static configuration or Helm values for the two providers. Look for the Kubernetes Gateway provider and for providers.rest:
kubectl get deploy -n <traefik-namespace> traefik -o yaml | grep -i -E "providers\.(rest|kubernetesgateway)"
Finally, list which namespaces and users can create HTTPRoute resources on your shared Gateways.
What to do now
- Upgrade Traefik to 2.11.46, 3.6.17 or 3.7.1, whichever matches your branch.
- Disable the REST provider if you do not use it. The attack path needs it enabled.
- Restrict which namespaces a shared Gateway accepts routes from, and limit RBAC for HTTPRoute creation to trusted teams.
- Review existing HTTPRoutes for backend references to Traefik internal services, such as names ending in the internal marker.
- Check live dynamic configuration for routers and services you did not create.
Why it matters
The record lists CWE-15 (external control of system or configuration setting) and CWE-284 (improper access control). The setting providers.rest.insecure=false is meant to stop Traefik from publishing its REST handler on its built in internal router. The Gateway API provider, though, accepted any TraefikService backend whose name ended with the internal marker. That let a tenant route traffic to the REST handler in addition to the dashboard handler.
The REST provider accepts live dynamic configuration. Write access to it means an actor can change routers and services on the proxy that fronts other tenants, so a low privilege Kubernetes user can affect traffic that belongs to others. That is the reason the scope is changed in the CVSS vector.
The record does not mark this CVE as KEV. Multi tenant ingress is a place where a small validation gap, here a suffix match, turns into a boundary break.
Quick check
Does this affect me if I do not use the Gateway API provider?
The advisory describes the issue in that provider. Without it, this path does not apply, but upgrade on your normal schedule.
Is turning off the REST provider enough?
It removes the exposed handler, so it blocks this path. The fix is still the upgrade.
Sources
Last reviewed: 19 October 2026.
