CVE-2026-94572

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-94572", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-09-21T20:13:35.187Z", "datePublished": "2026-09-21T20:13:35.557Z", "dateUpdated": "2026-09-24T22:41:15.736Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Octavia", "repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "versions": [{"lessThan": "16.1.0", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThan": "17.0.1", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "18.0.1", "status": "affected", "version": "18.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.4, "baseSeverity": "CRITICAL", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-21T20:13:35.557Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/octavia/+bug/2162101"}, {"tags": ["issue-tracking"], "url": "https://bugs.launchpad.net/octavia/+bug/2167565"}, {"tags": ["issue-tracking"], "url": "https://bugs.debian.org/1148175"}, {"tags": ["patch"], "url": "https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d"}, {"tags": ["vendor-advisory"], "url": "https://security.openstack.org/ossa/OSSA-2026-039.html"}, {"tags": ["mailing-list"], "url": "https://openwall.com/lists/oss-security/2026/09/21/6"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.0", "versionEndExcluding": "16.1.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "17.0.0", "versionEndExcluding": "17.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "versionStartIncluding": "18.0.0", "versionEndExcluding": "18.0.1"}]}]}]}, "adp": [{"references": [{"url": "https://bugs.launchpad.net/octavia/+bug/2162101", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-24T22:40:50.327335Z", "id": "CVE-2026-94572", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T22:41:15.736Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-94572", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-24T22:40:50.327335Z"}}}], "references": [{"url": "https://bugs.launchpad.net/octavia/+bug/2162101", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-24T22:41:10.121Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "product": "Octavia", "versions": [{"status": "affected", "version": "6.0.0", "lessThan": "16.1.0", "versionType": "semver"}, {"status": "affected", "version": "17.0.0", "lessThan": "17.0.1", "versionType": "semver"}, {"status": "affected", "version": "18.0.0", "lessThan": "18.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://bugs.launchpad.net/octavia/+bug/2162101", "tags": ["issue-tracking"]}, {"url": "https://bugs.launchpad.net/octavia/+bug/2167565", "tags": ["issue-tracking"]}, {"url": "https://bugs.debian.org/1148175", "tags": ["issue-tracking"]}, {"url": "https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d", "tags": ["patch"]}, {"url": "https://security.openstack.org/ossa/OSSA-2026-039.html", "tags": ["vendor-advisory"]}, {"url": "https://openwall.com/lists/oss-security/2026/09/21/6", "tags": ["mailing-list"]}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "16.1.0", "versionStartIncluding": "6.0.0"}, {"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "17.0.1", "versionStartIncluding": "17.0.0"}, {"criteria": "cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "18.0.1", "versionStartIncluding": "18.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-09-21T20:13:35.557Z"}}}, "cveMetadata": {"cveId": "CVE-2026-94572", "state": "PUBLISHED", "dateUpdated": "2026-09-24T22:41:15.736Z", "dateReserved": "2026-09-21T20:13:35.187Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-09-21T20:13:35.557Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Octavia", "repo": "https://opendev.org/openstack/octavia", "vendor": "OpenStack", "versions": [{"lessThan": "16.1.0", "status": "affected", "version": "6.0.0", "versionType": "semver"}, {"lessThan": "17.0.1", "status": "affected", "version": "17.0.0", "versionType": "semver"}, {"lessThan": "18.0.1", "status": "affected", "version": "18.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected."}], "id": "CVE-2026-94572", "lastModified": "2026-09-24T23:19:22.677", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-94572", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-24T22:40:50.327335Z", "version": "2.0.3"}}]}, "published": "2026-09-21T21:17:22.150", "references": [{"source": "cve@mitre.org", "url": "https://bugs.debian.org/1148175"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/octavia/+bug/2162101"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/octavia/+bug/2167565"}, {"source": "cve@mitre.org", "url": "https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d"}, {"source": "cve@mitre.org", "url": "https://openwall.com/lists/oss-security/2026/09/21/6"}, {"source": "cve@mitre.org", "url": "https://security.openstack.org/ossa/OSSA-2026-039.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://bugs.launchpad.net/octavia/+bug/2162101"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "openstack-octavia: octavia: HAProxy configuration injection via tls_ciphers on pools and listeners", "id": "2538268", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538268"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-94", "details": ["A flaw was found in OpenStack Octavia. The tls_ciphers field on listeners and pools does not reject control characters or spaces. An authenticated project member can embed extra text in that field so that HAProxy treats it as additional configuration rather than a cipher list. This can change HAProxy behavior on the Amphora VM and, by injecting HAProxy program directives, can run commands on the Amphora. Only deployments that use the Amphora provider are affected."], "mitigation": {"lang": "en:us", "value": "There is no complete mitigation for Amphora-based deployments other than restricting who can update listener and pool TLS settings. Operators can tighten Octavia policy.yaml so that os_load-balancer_api:pool:put and os_load-balancer_api:listener:put are limited to trusted roles. Deployments using the OVN provider instead of Amphora are not affected."}, "name": "CVE-2026-94572", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "openstack-octavia", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-21T20:13:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-94572\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-94572\nhttps://bugs.debian.org/1148175\nhttps://bugs.launchpad.net/octavia/+bug/2162101\nhttps://bugs.launchpad.net/octavia/+bug/2167565\nhttps://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d\nhttps://openwall.com/lists/oss-security/2026/09/21/6\nhttps://security.openstack.org/ossa/OSSA-2026-039.html"], "statement": "This vulnerability is rated as Important because an authenticated project member can inject HAProxy configuration through tls_ciphers and run commands as root on the provider-managed Amphora for their load balancer. The Amphora has a network interface on the isolated load-balancer management network (lb-mgmt-net). It is not rated Critical because exploitation requires a valid OpenStack account with load-balancer:write, and Amphorae are single-tenant by design: other tenants' TLS private keys are not stored on the compromised VM. Upstream (OSSA-2026-039) treats this as a class A issue for the management-network foothold, while noting that stolen Amphora identity material is mainly useful on lb-mgmt-net. Red Hat OpenStack Platform deployments that use the Amphora provider for Octavia are affected. Deployments that use the OVN provider are not affected because they do not generate HAProxy configuration files.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.0.0,16.1.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.0.0,17.0.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.0.0,18.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Octavia", "source": "cna", "vendor": "OpenStack"}, "product": "octavia", "vendor": "openstack"}], "created": "2026-09-21T21:45:17.540666+00:00", "title": "TLS Cipher Injection in OpenStack Octavia Amphora Provider", "updated": "2026-09-21T22:30:12.367675+00:00", "vendors": ["openstack", "openstack$PRODUCT$octavia"]}