CVE-2026-108334

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108334", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-10-09T19:33:38.381Z", "datePublished": "2026-10-15T18:44:42.472Z", "dateUpdated": "2026-11-05T16:46:05.317Z"}, "containers": {"cna": {"title": "Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route\u2019s backend."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Connectivity Link 1.4", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhcl-1/rhcl-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1791975888", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:connectivity_link:1.4::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Connectivity Link 1.5", "collectionURL": "https://catalog.redhat.com/software/containers/", "packageName": "rhcl-1/rhcl-rhel9-operator", "defaultStatus": "affected", "versions": [{"version": "1792512519", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:connectivity_link:1.5::el9"]}, {"vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcl-1/developer-portal-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:connectivity_link:1"]}, {"vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhcl-1/rhcl-operator-bundle", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:connectivity_link:1"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-model-controller-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}, {"vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "rhoai/odh-model-serving-api-rhel9", "defaultStatus": "unaffected", "cpes": ["cpe:/a:redhat:openshift_ai"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:83531", "name": "RHSA-2026:83531", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:88203", "name": "RHSA-2026:88203", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-108334", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548768", "name": "RHBZ#2548768", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a"}, {"url": "https://github.com/advisories/GHSA-fcw2-f6v9-6ffp"}], "datePublic": "2026-10-15T16:53:51.890Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-917", "description": "Improper Neutralization of Special Elements used in an Expression Language Statement", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement", "workarounds": [{"lang": "en", "value": "Until a fixed release is available, restrict HTTPRoute creation and modification for routes attached to the shared Gateway, and review or remove routes with match values that trigger the predicate injection. Where possible, enforce authentication and rate limiting at the backend as additional controls. An admission policy could reject confirmed exploit patterns, but validate it against legitimate routes; Gateway API match values can contain special characters. These measures reduce exposure but do not fix the shim. The backend and admission-policy measures are compensating controls; their effectiveness depends on the deployment and the specific route behavior"}], "timeline": [{"lang": "en", "time": "2026-10-01T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-15T16:53:51.890Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:46:05.317Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T20:08:09.050952Z", "id": "CVE-2026-108334", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T20:08:20.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-108334", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T20:08:09.050952Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T20:08:14.429Z"}}], "cna": {"title": "Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"cpes": ["cpe:/a:redhat:connectivity_link:1.4::el9"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1.4", "versions": [{"status": "unaffected", "version": "1791975888", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhcl-1/rhcl-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:connectivity_link:1.5::el9"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1.5", "versions": [{"status": "unaffected", "version": "1792512519", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhcl-1/rhcl-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:connectivity_link:1"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "packageName": "rhcl-1/developer-portal-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:connectivity_link:1"], "vendor": "Red Hat", "product": "Red Hat Connectivity Link 1", "packageName": "rhcl-1/rhcl-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-controller-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-serving-api-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-01T00:00:00.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-10-15T16:53:51.890Z", "value": "Made public."}], "datePublic": "2026-10-15T16:53:51.890Z", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:83531", "name": "RHSA-2026:83531", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:88203", "name": "RHSA-2026:88203", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2026-108334", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548768", "name": "RHBZ#2548768", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a"}, {"url": "https://github.com/advisories/GHSA-fcw2-f6v9-6ffp"}], "workarounds": [{"lang": "en", "value": "Until a fixed release is available, restrict HTTPRoute creation and modification for routes attached to the shared Gateway, and review or remove routes with match values that trigger the predicate injection. Where possible, enforce authentication and rate limiting at the backend as additional controls. An admission policy could reject confirmed exploit patterns, but validate it against legitimate routes; Gateway API match values can contain special characters. These measures reduce exposure but do not fix the shim. The backend and admission-policy measures are compensating controls; their effectiveness depends on the deployment and the specific route behavior"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route\u2019s backend."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-917", "description": "Improper Neutralization of Special Elements used in an Expression Language Statement"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-05T16:46:05.317Z"}, "x_redhatCweChain": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement"}}, "cveMetadata": {"cveId": "CVE-2026-108334", "state": "PUBLISHED", "dateUpdated": "2026-11-05T16:46:05.317Z", "dateReserved": "2026-10-09T19:33:38.381Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2026-10-15T18:44:42.472Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:connectivity_link:1.4::el9"], "defaultStatus": "affected", "packageName": "rhcl-1/rhcl-rhel9-operator", "product": "Red Hat Connectivity Link 1.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1791975888", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:connectivity_link:1.5::el9"], "defaultStatus": "affected", "packageName": "rhcl-1/rhcl-rhel9-operator", "product": "Red Hat Connectivity Link 1.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1792512519", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/developer-portal-controller-rhel9", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:connectivity_link:1"], "defaultStatus": "unaffected", "packageName": "rhcl-1/rhcl-operator-bundle", "product": "Red Hat Connectivity Link 1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-controller-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-serving-api-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route\u2019s backend."}], "id": "CVE-2026-108334", "lastModified": "2026-10-23T05:17:13.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 3.7, "source": "secalert@redhat.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108334", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T20:08:09.050952Z", "version": "2.0.3"}}]}, "published": "2026-10-15T19:17:20.187", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:83531"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2026:88203"}, {"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-108334"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548768"}, {"source": "secalert@redhat.com", "url": "https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a"}, {"source": "secalert@redhat.com", "url": "https://github.com/advisories/GHSA-fcw2-f6v9-6ffp"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-917"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: Crafted HTTPRoute match values can bypass Gateway policy overrides", "id": "2548768", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548768"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-917", "details": ["A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route\u2019s backend."], "mitigation": {"lang": "en:us", "value": "Until a fixed release is available, restrict HTTPRoute creation and modification for routes attached to the shared Gateway, and review or remove routes with match values that trigger the predicate injection. Where possible, enforce authentication and rate limiting at the backend as additional controls. An admission policy could reject confirmed exploit patterns, but validate it against legitimate routes; Gateway API match values can contain special characters. These measures reduce exposure but do not fix the shim. The backend and admission-policy measures are compensating controls; their effectiveness depends on the deployment and the specific route behavior"}, "name": "CVE-2026-108334", "package_state": [{"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Affected", "package_name": "rhcl-1/developer-portal-controller-rhel9", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Not affected", "package_name": "rhcl-1/rhcl-operator-bundle", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:connectivity_link:1", "fix_state": "Affected", "package_name": "rhcl-1/rhcl-rhel9-operator", "product_name": "Red Hat Connectivity Link 1"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-model-controller-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-model-serving-api-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-15T16:53:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-108334\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-108334"], "statement": "A tenant user with permission to write HTTPRoutes can bypass provider-enforced Gateway authentication and rate limiting for a route they control, even when those policies are configured as mandatory overrides. This can expose that tenant\u2019s protected application endpoints to requests that bypass Gateway authentication and allow traffic beyond the configured rate limit. The described impact is limited to the route writer\u2019s tenant; it does not allow one tenant \nto affect another tenant\u2019s routes.", "threat_severity": "Important"}

{"created": "2026-10-16T06:45:14.856607+00:00", "updated": "2026-10-16T06:45:14.856616+00:00", "vendors": []}