CVE-2026-108334

Awaiting Analysis Awaiting Analysis - Queue

Kuadrant Operator WebAssembly Shim CEL Predicate Bypass

Publication date: 2026-10-15

Last updated on: 2026-10-17

Assigner: redhat-SADP

Description

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-16

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108334

EUVD

EUVD-2026-102322

Affected Vendors & Products

Vendor	Product	Version / Range
Red	Hat	Red Hat Connectivity Link 1 *
Red	Hat	Red Hat OpenShift AI (RHOAI) *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-917	The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

Executive Summary

This vulnerability is in the Kuadrant operator's internal WebAssembly shim. It allows HTTPRoute match fields to bypass Gateway-level authentication and rate limiting. Crafted path, header, or query match values in an HTTPRoute can cause the predicate to skip these checks, even when policies are set as mandatory overrides.

Detection Guidance

Review HTTPRoute resources for suspicious match values in paths, headers, or query parameters that may bypass security checks. Check Gateway-level authentication and rate limiting logs for unexpected skipped policies. Monitor for unauthorized access attempts or unusual traffic patterns targeting protected endpoints.

Impact Analysis

A tenant user with HTTPRoute modification permissions can bypass security controls for their own routes. This exposes protected application endpoints to unauthorized access or excessive traffic. The impact is limited to the route writer's tenant and does not affect other tenants.

Compliance Impact

This vulnerability could lead to unauthorized access to protected endpoints, potentially violating data protection requirements under GDPR and HIPAA. It may result in unauthorized data exposure or excessive traffic, compromising confidentiality and integrity of sensitive information.

Mitigation Strategies

Restrict HTTPRoute creation/modification permissions to trusted users only. Review existing HTTPRoutes for crafted match values. Implement additional backend authentication and rate limiting controls. Monitor routes for unauthorized changes and enforce mandatory policy overrides where possible.

Hi! I’m here to help you understand CVE-2026-108334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70