CVE-2026-94572

Received Received - Intake

OpenStack Octavia TLS Cipher Control Character Injection

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: MITRE

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-94572

EUVD

EUVD-2026-84118

Affected Vendors & Products

Vendor	Product	Version / Range
openstack	octavia	to 18.0.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability exists in OpenStack Octavia before version 18.0.1. The Amphora provider driver fails to validate the listener and pool tls_ciphers field for control characters. This allows an authenticated project member with a TLS-enabled load balancer to inject newline characters into the HAProxy configuration on the amphora, enabling arbitrary configuration directive injection.

Detection Guidance

Check Octavia Amphora provider configurations for listener and pool tls_ciphers fields containing control characters. Review HAProxy configuration files on amphorae for unexpected newline characters or injected directives. Use grep to search for tls_ciphers entries with control characters: grep -r 'tls_ciphers.*[[:cntrl:]]' /etc/octavia/ or similar paths.

Impact Analysis

An attacker with access could modify HAProxy configurations, potentially leading to unauthorized access, data interception, or service disruption. This could affect the confidentiality, integrity, and availability of load-balanced services.

Compliance Impact

This vulnerability could lead to data breaches or unauthorized access, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Compliance may be compromised if sensitive data is exposed or altered due to the misconfiguration.

Mitigation Strategies

Upgrade OpenStack Octavia to version 18.0.1 or later to address the validation issue. Review and sanitize existing tls_ciphers configurations to remove any control characters. Restrict project member access to TLS-enabled load balancer configurations until patches are applied.

Hi! I’m here to help you understand CVE-2026-94572. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70