CVE-2026-94571

Received Received - Intake

OpenStack Octavia Amphora Provider URL Injection Vulnerability

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: MITRE

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94571

EUVD

EUVD-2026-84116

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	octavia	to 18.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenStack Octavia before version 18.0.1. The Amphora provider driver fails to block control characters in L7 policy redirect_url and redirect_prefix fields. While RFC 3986 URL validation percent-encodes control characters, Octavia stores and writes the raw unencoded values directly into HAProxy configuration files on the amphora. This allows authenticated project members with load balancer ownership to inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy.

Detection Guidance

This vulnerability can be detected by checking for unauthorized HAProxy configurations on Amphora instances. Inspect HAProxy configuration files on amphorae for unexpected directives or URLs containing control characters. Look for L7 policies with REDIRECT_TO_URL actions that include newline or control characters in redirect_url or redirect_prefix fields.

Impact Analysis

An attacker with authenticated access to a project can exploit this to inject malicious HAProxy directives. This could lead to unauthorized access, data exfiltration, or denial of service by manipulating load balancer traffic handling. Only deployments using the Amphora provider are affected.

Compliance Impact

This vulnerability allows authenticated project members to inject arbitrary HAProxy directives through manipulated L7 policy fields, potentially leading to unauthorized access or data exfiltration. Such unauthorized access could violate GDPR's data protection requirements or HIPAA's security and privacy rules by exposing sensitive data or enabling unauthorized modifications to system configurations.

Mitigation Strategies

Upgrade OpenStack Octavia to version 18.0.1 or later to address the vulnerability in the Amphora provider driver handling of L7 policy redirect fields.

Hi! I’m here to help you understand CVE-2026-94571. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70