UNKNOWN OpenStack
CVE-2026-94572
OSSA-2026-039: HAProxy configuration injection leading to remote code execution in Octavia
Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported input validation flaws in the Octavia load balancer API. The listener and pool tls_ciphers fields and the L7 policy redirect_url and redirect_prefix fields were written into the HAProxy configuration generated on the amphora without rejecting control characters, allowing an authenticated user who owns a load balancer managed by OpenStack Octavia’s Amphora provider to inject arbitrary HAProxy configurati
Affected Products
- Octavia: >=0.8.0 <16.1.0, ==17.0.0, ==18.0.0
- CVE-2026-94572
- CVE-2026-94571
References
- https://security.openstack.org/ossa/OSSA-2026-039.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-94572
- https://nvd.nist.gov/vuln/detail/CVE-2026-94571
This unknown severity vulnerability was published on 2026-09-21 via OpenStack. Affected: Octavia: >=0.8.0 <16.1.0, ==17.0.0, ==18.0.0, CVE-2026-94572, CVE-2026-94571.
vulnfeed aggregates 16809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.