{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Traefik versions v3.7.x ant\u00e9rieures \u00e0 v3.7.1",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Traefik versions v3.6.x ant\u00e9rieures \u00e0 v3.6.17",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    },
    {
      "description": "Traefik versions ant\u00e9rieures \u00e0 v2.11.46",
      "product": {
        "name": "Traefik",
        "vendor": {
          "name": "Traefik",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-44774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44774"
    }
  ],
  "initial_release_date": "2026-05-12T00:00:00",
  "last_revision_date": "2026-05-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0561",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Traefik. Elle permet \u00e0 un attaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Traefik",
  "vendor_advisories": [
    {
      "published_at": "2026-05-11",
      "title": "Bulletin de s\u00e9curit\u00e9 Traefik GHSA-96qj-4jj5-wcjc",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "traefik",
          "vendor": "traefik",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.11.46"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.0.0-beta1, \u003c 3.6.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.7.0-rc.0, \u003c 3.7.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:openshift_devspaces:3.29::el9"
          ],
          "defaultStatus": "affected",
          "product": "Red Hat OpenShift Dev Spaces 3.29",
          "vendor": "Red Hat"
        },
        {
          "cpes": [
            "cpe:/a:redhat:openshift_gitops:1"
          ],
          "defaultStatus": "unaffected",
          "product": "Red Hat OpenShift GitOps",
          "vendor": "Red Hat"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "2FBDBA4B-9AFC-4B78-9847-01614C64A2D7",
              "versionEndExcluding": "2.11.46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "3C7FED20-2311-46D0-B184-2B9EC98C66BA",
              "versionEndExcluding": "3.6.17",
              "versionStartIncluding": "3.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7C792C4-828F-413A-8BC9-A8AF1EBAFCC3",
              "versionEndExcluding": "3.7.1",
              "versionStartIncluding": "3.7.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik\u0027s Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1."
    }
  ],
  "id": "CVE-2026-44774",
  "lastModified": "2026-07-09T13:17:19.587",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.5,
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "HIGH",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-44774",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-16T01:12:38.060089Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-15T17:16:48.210",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.46"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.17"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.1"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/errata/RHSA-2026:36820"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://access.redhat.com/security/cve/CVE-2026-44774"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477937"
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44774.json"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-15"
        }
      ],
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.7.0"
            },
            {
              "fixed": "3.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.0"
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.6.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.11.45"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.11.46"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/traefik/traefik"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.7.34"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44774"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-13T15:29:56Z",
    "nvd_published_at": "2026-05-15T17:16:48Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThere is a medium severity vulnerability in Traefik\u0027s Kubernetes Gateway API provider that allows a tenant with `HTTPRoute` creation permissions to expose the REST provider handler, bypassing the `providers.rest.insecure=false` setting. The Gateway provider accepts any `TraefikService` backend reference whose name ends with `@internal`, making it possible to route traffic to `rest@internal` in addition to the intended `api@internal`. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.46\n- https://github.com/traefik/traefik/releases/tag/v3.6.17\n- https://github.com/traefik/traefik/releases/tag/v3.7.1\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n\u003cdetails\u003e\n\u003csummary\u003eOriginal Description\u003c/summary\u003e\n\n### Summary\nWhen the Kubernetes Gateway API provider is enabled, Traefik accepts any `TraefikService` backend whose name ends with `@internal`. This allows a tenant-controlled `HTTPRoute` to publish `rest@internal`.\n\nIf `providers.rest` is enabled, this exposes Traefik\u0027s REST provider handler even when `providers.rest.insecure=false`, even though providers.rest.insecure=false is meant to keep the REST handler from being exposed by Traefik\u0027s built-in internal router. In a shared Gateway deployment, an actor with permission to create or update `HTTPRoute` resources in an allowed namespace can gain live Traefik dynamic-configuration write access through `PUT /api/providers/rest`.\n\n### Details\nThe Gateway provider treats internal services broadly rather than allowing only a specific internal target.\n\nIn current `master`, `pkg/provider/kubernetes/gateway/kubernetes.go` defines `isInternalService(...)` as any `TraefikService` reference whose name ends with `@internal`.\n\nThen `pkg/provider/kubernetes/gateway/httproute.go` special-cases a single backend reference that matches `isInternalService(...)` and directly assigns `router.Service = string(routeRule.BackendRefs[0].Name)`.\n\nThis means a tenant route can target not only `api@internal`, but also `rest@internal` and other internal handlers.\n\nSeparately, the REST provider handler is created whenever the REST provider is enabled. In `pkg/server/service/managerfactory.go`, if `staticConfiguration.Providers.Rest != nil`, Traefik sets `factory.restHandler = staticConfiguration.Providers.Rest.CreateRouter()`.\n\nThe REST provider handler itself is implemented in `pkg/provider/rest/rest.go` and accepts `PUT /api/providers/{provider}`.\n\nThe `providers.rest.insecure` flag does not disable the underlying handler. In `pkg/provider/traefik/internal.go`, that flag only controls whether Traefik creates its own built-in internal router for `rest@internal`. Even when `providers.rest.insecure=false`, Traefik still registers the `rest` service object, and the service layer can still resolve `rest@internal` if another provider routes to it.\n\nI validated this locally in two tests:\n1. the Gateway route-building path accepts `rest@internal` as an internal backend through the same special-case branch used for `api@internal`\n2. the service layer builds and serves `rest@internal` successfully when `providers.rest` is enabled and `providers.rest.insecure=false`\n\nThe vulnerable code path is present in:\n- `v3.0.0`\n- `v3.6.7`\n- `v2.11.0`\n- `v2.11.36`\n- current `master` at `786f7192e11878dfaa634f8263bf79bb730a71cb`\n\nI verified the issue in v3.0.0, v3.6.7, v2.11.0, v2.11.36, and current master; the reported affected ranges reflect the maintained release lines checked during validation\n\nI did not find a public Traefik advisory or CVE for this exact issue. The closest public overlap I found is the documented/tested Gateway support for `api@internal`, but the issue here is broader because the Gateway code accepts any `@internal` `TraefikService`, including the write-capable `rest@internal` handler.\n\n### Expected behavior\n`providers.rest.insecure=false` should prevent low-privileged route authors from exposing the REST provider handler.\n\n### Actual behavior\nA tenant-controlled Gateway route can still publish `rest@internal` and reach the REST update API.\n\n### Attacker prerequisites\n- The Kubernetes Gateway API provider is enabled.\n- `providers.rest=true`.\n- `providers.rest.insecure=false`.\n- A shared Gateway allows tenant namespaces to attach `HTTPRoute` resources.\n- The attacker can create or update `HTTPRoute` resources in an allowed tenant namespace.\n\n### PoC\n1. Configure Traefik so that the Kubernetes Gateway provider is enabled, the REST provider is enabled, and the REST provider is not exposed insecurely.\n\nExample static configuration:\n\n```yaml\nproviders:\n  kubernetesGateway: {}\n  rest:\n    insecure: false\n```\n\n2. Ensure a shared Gateway allows tenant `HTTPRoute` attachment.\n\n3. In an allowed tenant namespace, create an `HTTPRoute` whose backend points to `rest@internal`:\n\n```yaml\napiVersion: gateway.networking.k8s.io/v1\nkind: HTTPRoute\nmetadata:\n  name: expose-rest-internal\n  namespace: tenant-a\nspec:\n  parentRefs:\n    - name: shared-gateway\n      namespace: infra\n  hostnames:\n    - rest.tenant.example\n  rules:\n    - matches:\n        - path:\n            type: PathPrefix\n            value: /\n      backendRefs:\n        - group: traefik.io\n          kind: TraefikService\n          name: rest@internal\n          port: 80\n```\n\n4. Send a `PUT` request through that published route to `/api/providers/rest` with a valid dynamic configuration body. A harmless proof can add a dummy router pointing to `noop@internal`.\n\nExample request body:\n\n```json\n{\n  \"http\": {\n    \"routers\": {\n      \"probe\": {\n        \"rule\": \"PathPrefix(`/probe`)\",\n        \"service\": \"noop@internal\",\n        \"ruleSyntax\": \"default\"\n      }\n    }\n  }\n}\n```\n\n5. Observe that Traefik accepts the update and applies the supplied dynamic configuration, even though `providers.rest.insecure=false`.\n\n### Impact\nThis is an authorization / trust-boundary bypass affecting shared Gateway deployments.\n\nOn affected deployments, an actor who should only be able to create or update `HTTPRoute` objects can escalate to live Traefik dynamic-configuration write access. That can allow unauthorized reconfiguration of routers and services, publication of additional internal surfaces, request interception or rerouting, and denial of service through destructive config changes.\n\nOn affected deployments, this gives a low-privileged Gateway route author live Traefik dynamic-configuration write access. This is critical for affected shared Gateway deployments because it can give a low-privileged route author live Traefik dynamic-configuration write access, but it depends on providers.rest being enabled.\n\nThis is not an unauthenticated vulnerability in all Traefik deployments. The issue depends on realistic but specific conditions:\n- `providers.rest` must be enabled\n- the attacker must be allowed to attach `HTTPRoute` resources to a shared Gateway\n\n\u003c/details\u003e",
  "id": "GHSA-96qj-4jj5-wcjc",
  "modified": "2026-05-15T23:50:03Z",
  "published": "2026-05-13T15:29:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/security/advisories/GHSA-96qj-4jj5-wcjc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44774"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/traefik/traefik"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v2.11.46"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.6.17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/traefik/traefik/releases/tag/v3.7.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST provider despite providers.rest.insecure=false"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "traefik-3.6.17-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the traefik-3.6.17-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10810",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10810-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-44774 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-44774/"
      }
    ],
    "title": "traefik-3.6.17-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-18T00:00:00Z",
      "generator": {
        "date": "2026-05-18T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10810-1",
      "initial_release_date": "2026-05-18T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-18T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.17-1.1.aarch64",
                "product": {
                  "name": "traefik-3.6.17-1.1.aarch64",
                  "product_id": "traefik-3.6.17-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.17-1.1.ppc64le",
                "product": {
                  "name": "traefik-3.6.17-1.1.ppc64le",
                  "product_id": "traefik-3.6.17-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.17-1.1.s390x",
                "product": {
                  "name": "traefik-3.6.17-1.1.s390x",
                  "product_id": "traefik-3.6.17-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik-3.6.17-1.1.x86_64",
                "product": {
                  "name": "traefik-3.6.17-1.1.x86_64",
                  "product_id": "traefik-3.6.17-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.17-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.17-1.1.aarch64"
        },
        "product_reference": "traefik-3.6.17-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.17-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.17-1.1.ppc64le"
        },
        "product_reference": "traefik-3.6.17-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.17-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.17-1.1.s390x"
        },
        "product_reference": "traefik-3.6.17-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik-3.6.17-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik-3.6.17-1.1.x86_64"
        },
        "product_reference": "traefik-3.6.17-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44774",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-44774"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik\u0027s Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik-3.6.17-1.1.aarch64",
          "openSUSE Tumbleweed:traefik-3.6.17-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik-3.6.17-1.1.s390x",
          "openSUSE Tumbleweed:traefik-3.6.17-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-44774",
          "url": "https://www.suse.com/security/cve/CVE-2026-44774"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265372 for CVE-2026-44774",
          "url": "https://bugzilla.suse.com/1265372"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik-3.6.17-1.1.aarch64",
            "openSUSE Tumbleweed:traefik-3.6.17-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik-3.6.17-1.1.s390x",
            "openSUSE Tumbleweed:traefik-3.6.17-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-44774"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "traefik2-2.11.46-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the traefik2-2.11.46-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-10811",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10811-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-44774 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-44774/"
      }
    ],
    "title": "traefik2-2.11.46-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-05-18T00:00:00Z",
      "generator": {
        "date": "2026-05-18T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:10811-1",
      "initial_release_date": "2026-05-18T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-05-18T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik2-2.11.46-1.1.aarch64",
                "product": {
                  "name": "traefik2-2.11.46-1.1.aarch64",
                  "product_id": "traefik2-2.11.46-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik2-2.11.46-1.1.ppc64le",
                "product": {
                  "name": "traefik2-2.11.46-1.1.ppc64le",
                  "product_id": "traefik2-2.11.46-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik2-2.11.46-1.1.s390x",
                "product": {
                  "name": "traefik2-2.11.46-1.1.s390x",
                  "product_id": "traefik2-2.11.46-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "traefik2-2.11.46-1.1.x86_64",
                "product": {
                  "name": "traefik2-2.11.46-1.1.x86_64",
                  "product_id": "traefik2-2.11.46-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik2-2.11.46-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik2-2.11.46-1.1.aarch64"
        },
        "product_reference": "traefik2-2.11.46-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik2-2.11.46-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik2-2.11.46-1.1.ppc64le"
        },
        "product_reference": "traefik2-2.11.46-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik2-2.11.46-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik2-2.11.46-1.1.s390x"
        },
        "product_reference": "traefik2-2.11.46-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "traefik2-2.11.46-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:traefik2-2.11.46-1.1.x86_64"
        },
        "product_reference": "traefik2-2.11.46-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44774",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-44774"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik\u0027s Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:traefik2-2.11.46-1.1.aarch64",
          "openSUSE Tumbleweed:traefik2-2.11.46-1.1.ppc64le",
          "openSUSE Tumbleweed:traefik2-2.11.46-1.1.s390x",
          "openSUSE Tumbleweed:traefik2-2.11.46-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-44774",
          "url": "https://www.suse.com/security/cve/CVE-2026-44774"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1265372 for CVE-2026-44774",
          "url": "https://bugzilla.suse.com/1265372"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:traefik2-2.11.46-1.1.aarch64",
            "openSUSE Tumbleweed:traefik2-2.11.46-1.1.ppc64le",
            "openSUSE Tumbleweed:traefik2-2.11.46-1.1.s390x",
            "openSUSE Tumbleweed:traefik2-2.11.46-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-18T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-44774"
    }
  ]
}