REDHAT-BUG-2477937: High severity Traefik traefik vulnerability
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider handler, bypassing the providers.rest.insecure=false setting. The Gateway provider accepts any TraefikService backend reference whose name ends with @internal, making it possible to route traffic to rest@internal in addition to the intended api@internal. In shared Gateway deployments where the REST provider is enabled, this allows a low-privileged actor to gain live dynamic configuration write access to Traefik, enabling unauthorized reconfiguration of routers and services. This vulnerability is fixed in 2.11.46, 3.6.17, and 3.7.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 2.11.46 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.6.17 - Upgrade
Upgrade
Traefikto a version that resolves this vulnerability.Fixed in 3.7.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2477937?
The severity of REDHAT-BUG-2477937 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2477937?
To fix REDHAT-BUG-2477937, upgrade to Traefik versions 2.11.46, 3.6.17, or 3.7.1 or later.
What does REDHAT-BUG-2477937 affect?
REDHAT-BUG-2477937 affects the Traefik HTTP reverse proxy and load balancer when utilizing the Kubernetes Gateway API.
What is the impact of REDHAT-BUG-2477937?
The impact of REDHAT-BUG-2477937 is that it allows unauthorized access to the REST provider handler, potentially exposing sensitive data.
When was REDHAT-BUG-2477937 published?
REDHAT-BUG-2477937 was published on May 15, 2026.