CVE-2026-109575
Received Received - Intake

Authentication Bypass in HAProxy Data Plane API

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: MITRE

Description
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109575
EUVD
EUVD-2026-97816

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
HAProxy Data Plane API EE 2.2.0-ee1
HAProxy Data Plane API EE 3.0-ee
HAProxy Data Plane API EE 3.1-ee
HAProxy Data Plane API EE 3.3-ee
HAProxy Data Plane API EE 3.4-ee
HAProxy Data Plane API CE 2.2.0
HAProxy Data Plane API CE 3.0.0
HAProxy Data Plane API CE 3.1.0
HAProxy Data Plane API CE 3.3.0
HAProxy Data Plane API CE 3.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects HAProxy Data Plane API versions 2.2.0 through 3.4.3. When a TLS Certificate Authority and numeric TLS port are configured, the application incorrectly disables Basic authentication globally across all listeners (HTTP, HTTPS, UNIX domain sockets). This happens because the shared internal request handler drops security controls for non-mTLS listeners when mTLS is active on HTTPS. Attackers can exploit this to bypass authentication and gain full API administrative access.

Detection Guidance

Check HAProxy Data Plane API version with: dataplaneapi --version. If running versions 2.2.0 to 3.4.3 (or corresponding Enterprise releases), the system is vulnerable. Inspect configuration for tls_ca and tls_port settings. Test HTTP/UNIX endpoints for unauthenticated access by sending requests without credentials.

Impact Analysis

Unauthenticated attackers can access sensitive HAProxy configuration data or replace the entire configuration via the API. This grants full administrative control over the load balancer, potentially allowing traffic redirection, service disruption, or exposure of confidential data. The impact is severe as it affects all non-mTLS listeners sharing the same handler.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. GDPR mandates strict authentication and authorization controls for processing personal data. HIPAA requires secure access to protected health information. The lack of authentication enforcement could lead to unauthorized access, data breaches, and non-compliance with these regulations.

Mitigation Strategies

Upgrade HAProxy Data Plane API to version 3.4.4 or later (or corresponding Enterprise releases). Disable HTTP and UNIX socket listeners if not required. Ensure mTLS is enforced on all HTTPS endpoints. Review and restrict network access to management endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart