CVE-2026-1784
Received
Received - Intake
Route HAProxy Configuration Injection in OpenShift
Publication date: 2026-06-02
Last updated on: 2026-06-02
Assigner: Red Hat, Inc.
Description
Description
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| redhat | openshift | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Route OpenShift resource, which is used to define routes that make pods reachable at a subdomain through HAProxy.
The issue is that the checks performed on the spec.path YAML stanza in a Route document are insufficient.
This insufficiency could allow an attacker to inject controlled HAProxy configuration, potentially manipulating how traffic is routed.
How can this vulnerability impact me? :
This vulnerability can have a severe impact as indicated by its CVSS score of 8.8.
- An attacker with low privileges and local access could exploit this to inject malicious HAProxy configurations.
- This could lead to complete compromise of confidentiality, integrity, and availability of the affected system.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70