CVE-2026-94571

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94571", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-21T20:09:16.460Z", "datePublished": "2026-09-21T20:09:16.848Z", "dateUpdated": "2026-09-22T13:36:39.179Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Octavia", "repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "versions": [{"lessThan": "16.1.0", "status": "affected", "version": "0.8.0", "versionType": "semver"}, {"lessThan": "17.0.1", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "18.0.1", "status": "affected", "version": "18.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-21T20:09:16.848Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/octavia/+bug/2162103"}, {"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/octavia/+bug/2167565"}, {"tags": ["issue-tracking"], "url": "https://bugs.debian.org/1148175"}, {"tags": ["patch"], "url": "https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-039.html"}, {"tags": ["mailing-list"], "url": "https://openwall.com/lists/oss-security/2026/09/21/6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.8.0", "versionEndExcluding": "16.1.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0.0", "versionEndExcluding": "17.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.0.0", "versionEndExcluding": "18.0.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-22T13:36:29.022324Z", "id": "CVE-2026-94571", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T13:36:39.179Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94571", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-22T13:36:29.022324Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-22T13:36:35.270Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "product": "Octavia", "versions": [{"status": "affected", "version": "0.8.0", "lessThan": "16.1.0", "versionType": "semver"}, {"status": "affected", "version": "17.0.0", "lessThan": "17.0.1", "versionType": "semver"}, {"status": "affected", "version": "18.0.0", "lessThan": "18.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/octavia/+bug/2162103", "tags": ["issue-tracking"]}, {"url": "https://bugs.launchpad.net/octavia/+bug/2167565", "tags": ["issue-tracking"]}, {"url": "https://bugs.debian.org/1148175", "tags": ["issue-tracking"]}, {"url": "https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39", "tags": ["patch"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-039.html", "tags": ["vendor-advisory"]}, {"url": "https://openwall.com/lists/oss-security/2026/09/21/6", "tags": ["mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.1.0", "versionStartIncluding": "0.8.0"}, {"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.0.1", "versionStartIncluding": "17.0.0"}, {"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "18.0.1", "versionStartIncluding": "18.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-21T20:09:16.848Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94571", "state": "PUBLISHED", "dateUpdated": "2026-09-22T13:36:39.179Z", "dateReserved": "2026-09-21T20:09:16.460Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-21T20:09:16.848Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Octavia", "repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "versions": [{"lessThan": "16.1.0", "status": "affected", "version": "0.8.0", "versionType": "semver"}, {"lessThan": "17.0.1", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "18.0.1", "status": "affected", "version": "18.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected."}], "id": "CVE-2026-94571", "lastModified": "2026-09-22T19:56:19.073", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94571", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-22T13:36:29.022324Z", "version": "2.0.3"}}]}, "published": "2026-09-21T21:17:21.970", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1148175"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/octavia/+bug/2162103"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/octavia/+bug/2167565"}, {"source": "cve@mitre.org", "url": "https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39"}, {"source": "cve@mitre.org", "url": "https://openwall.com/lists/oss-security/2026/09/21/6"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-039.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-octavia: octavia: HAProxy configuration injection via L7 policy redirect_url and redirect_prefix", "id": "2538157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538157"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in OpenStack Octavia. An authenticated user who can create or update L7 policies on their own load balancer can inject arbitrary HAProxy configuration directives through the redirect_url or redirect_prefix fields. The URL validator does not reject control characters such as tabs and newlines, and the raw input is written directly into the HAProxy configuration file on the Amphora VM. This can be used to change redirect behavior and, by injecting HAProxy program directives, to run commands on the Amphora."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for Amphora-based deployments other than restricting who can create or update L7 policies. Operators can tighten Octavia oslo.policy so that load-balancer:write, or L7 policy create and update, is limited to trusted users. If L7 redirects are not required, deny L7 policy create and update. Deployments using the OVN provider instead of Amphora are not affected."}, "name": "CVE-2026-94571", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-21T20:09:16Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94571\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94571\nhttps://bugs.debian.org/1148175\nhttps://bugs.launchpad.net/octavia/+bug/2162103\nhttps://bugs.launchpad.net/octavia/+bug/2167565\nhttps://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39\nhttps://openwall.com/lists/oss-security/2026/09/21/6\nhttps://security.openstack.org/ossa/OSSA-2026-039.html"], "statement": "This vulnerability is rated as Important because an authenticated project member can inject HAProxy configuration and run commands as root on the provider-managed Amphora for their load balancer. The Amphora has a network interface on the isolated load-balancer management network (lb-mgmt-net). It is not rated Critical because exploitation requires a valid OpenStack account with load-balancer:write, and Amphorae are single-tenant by design: other tenants' TLS private keys are not stored on the compromised VM. Upstream (OSSA-2026-039) treats this as a class A issue for the management-network foothold, while noting that stolen Amphora identity material is mainly useful on lb-mgmt-net. Red Hat OpenStack Platform deployments that use the Amphora provider for Octavia are affected. Deployments that use the OVN provider are not affected because they do not generate HAProxy configuration files.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.8.0,16.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.0.0,18.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Octavia", "source": "cna", "vendor": "OpenStack"}, "product": "octavia", "vendor": "openstack"}], "created": "2026-09-21T22:00:10.817659+00:00", "updated": "2026-09-21T22:15:17.567425+00:00", "vendors": ["openstack", "openstack$PRODUCT$octavia"]}