Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-94571: OpenStack Octavia Amphora allows redirect URL injection
CVE-2026-94571 · published 28 days ago
Summary
If you use OpenStack Octavia with the Amphora driver, a user who can manage load balancers could place control characters in a redirect URL, causing raw text to be written into the HAProxy configuration. This can let the user add unintended HAProxy commands, potentially altering traffic handling. Upgrade Octavia to version 18.0.1 or later, or switch to a different provider, to stop this behavior.
What to do
- Update debian octavia to version 18.0.0-4.
- Update canonical octavia to version 1:10.1.1-0ubuntu1.5.
- Update canonical octavia to version 1:14.0.0-0ubuntu1.6.
- Update canonical octavia to version 1:18.0.0-0ubuntu2.1.
- Update openstack octavia to version 16.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | openstack | octavia | < 16.1.0 |
| Ubuntu:20.04:LTS | canonical | octavia | All versions |
| Debian:12 | debian | octavia | All versions |
| Debian:14 | debian | octavia |
< 18.0.0-4 Fix: upgrade to 18.0.0-4
|
| Ubuntu:22.04:LTS | canonical | octavia |
< 1:10.1.1-0ubuntu1.5 Fix: upgrade to 1:10.1.1-0ubuntu1.5
|
| Ubuntu:24.04:LTS | canonical | octavia |
< 1:14.0.0-0ubuntu1.6 Fix: upgrade to 1:14.0.0-0ubuntu1.6
|
| Ubuntu:26.04:LTS | canonical | octavia |
< 1:18.0.0-0ubuntu2.1 Fix: upgrade to 1:18.0.0-0ubuntu2.1
|
Original advisory text
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encode...
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
References
- https://bugs.debian.org/1148175 Third Party Advisory
- https://bugs.launchpad.net/octavia/+bug/2162103 Third Party Advisory
- https://bugs.launchpad.net/octavia/+bug/2167565 Third Party Advisory
- https://openwall.com/lists/oss-security/2026/09/21/6 Third Party Advisory
- https://security.openstack.org/ossa/OSSA-2026-039.html Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-94571 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-94571 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-94571 Third Party Advisory
- https://bugs.launchpad.net/octavia/+bug/2162101 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-94571 Vendor Advisory
- https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8... Third Party Advisory
- https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f... Third Party Advisory
- https://ubuntu.com/security/notices/USN-8814-1 Vendor Advisory
- https://opendev.org/openstack/octavia URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94571... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-94Code Injection
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-94571 · NVD
CVE-2026-94571 · MITRE
CVE-2026-94571 · OSV
UBUNTU-CVE-2026-94571 · OSV
DEBIAN-CVE-2026-94571 · OSV
Track software like this
Free during beta