Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2026-1784: OpenShift routes let attackers change HAProxy configuration
CVE-2026-1784 · published 5 months ago
Summary
In OpenShift versions 4.13 through 4.18, the way routes are defined can let a user insert their own HAProxy settings. This could let an attacker run code on your servers or disrupt services. Update to the latest OpenShift patches and review any custom route definitions.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat openshift container platform 4.13 | All versions |
| red hat | red hat openshift container platform 4.14 | All versions |
| red hat | red hat openshift container platform 4.15 | All versions |
| red hat | red hat openshift container platform 4.16 | All versions |
| red hat | red hat openshift container platform 4.18 | All versions |
| red hat | red hat openshift container platform 4.19 | All versions |
| red hat | red hat openshift container platform 4.20 | All versions |
| red hat | red hat openshift container platform 4.21 | All versions |
| redhat | openshift_container_platform |
4.0 cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* |
| red hat | red hat openshift container platform 4.2 | All versions |
| red hat | red hat openshift container platform 4.12 | All versions |
Original advisory text
Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
References
- https://access.redhat.com/errata/RHSA-2026:23241
- https://access.redhat.com/errata/RHSA-2026:23246
- https://access.redhat.com/errata/RHSA-2026:25045
- https://access.redhat.com/errata/RHSA-2026:25194
- https://access.redhat.com/security/cve/CVE-2026-1784 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2436075 Issue Tracking Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:25182
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json
- https://access.redhat.com/errata/RHSA-2026:26543
- https://access.redhat.com/errata/RHSA-2026:28893
- https://access.redhat.com/errata/RHSA-2026:28964
- https://access.redhat.com/errata/RHSA-2026:70647
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-15External Control of System or Configuration Setting
Timeline
Published2 Jun 2026
Updated4 Nov 2026
First seen2 Jun 2026
Track software like this
Free during beta