Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-1784

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Red Hat Red Hat OpenShift Container Platform 4.12

Default version status: affected

  • 1789911929 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.13

Default version status: affected

  • 1781123014 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • 1781870101 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • 1781928857 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • 1780962617 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.18

Default version status: affected

  • 1780988280 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.19

Default version status: affected

  • 1780043338 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.20

Default version status: affected

  • 1780990977 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.21

Default version status: affected

  • 1780444348 to < *unaffected

References