{"id":"CVE-2026-1784","state":"PUBLISHED","title":"Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","publishedAt":"2026-06-02T07:22:26.461Z","updatedAt":"2026-10-01T16:33:32.870Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift Container Platform 4.12","Red Hat Red Hat OpenShift Container Platform 4.13","Red Hat Red Hat OpenShift Container Platform 4.14","Red Hat Red Hat OpenShift Container Platform 4.15","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Red Hat OpenShift Container Platform 4.18","Red Hat Red Hat OpenShift Container Platform 4.19","Red Hat Red Hat OpenShift Container Platform 4.20","Red Hat Red Hat OpenShift Container Platform 4.21"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1789911929","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781123014","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781870101","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1781928857","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780962617","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780988280","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780043338","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780990977","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780444348","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:23241","https://access.redhat.com/errata/RHSA-2026:23246","https://access.redhat.com/errata/RHSA-2026:25045","https://access.redhat.com/errata/RHSA-2026:25182","https://access.redhat.com/errata/RHSA-2026:25194","https://access.redhat.com/errata/RHSA-2026:26543","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28964","https://access.redhat.com/errata/RHSA-2026:70647","https://access.redhat.com/security/cve/CVE-2026-1784","https://bugzilla.redhat.com/show_bug.cgi?id=2436075","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json"],"weaknesses":["CWE-15"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/1xxx/CVE-2026-1784.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-1784","state":"PUBLISHED","datePublished":"2026-06-02T07:22:26.461Z","dateUpdated":"2026-10-01T16:33:32.870Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-02-02T21:17:24.893Z"},"containers":{"cna":{"title":"Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection","descriptions":[{"lang":"en","value":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1789911929","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781123014","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781870101","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1781928857","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780962617","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780988280","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780043338","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780990977","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780444348","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:23241","name":"RHSA-2026:23241","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23246","name":"RHSA-2026:23246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25045","name":"RHSA-2026:25045","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25182","name":"RHSA-2026:25182","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25194","name":"RHSA-2026:25194","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26543","name":"RHSA-2026:26543","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28893","name":"RHSA-2026:28893","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","name":"RHSA-2026:28964","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70647","name":"RHSA-2026:70647","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1784","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436075","name":"RHBZ#2436075","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-15","description":"External Control of System or Configuration Setting","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-01T16:33:32.870Z"},"datePublic":"2026-06-02T07:12:31.172Z","x_redhatCweChain":"CWE-15: External Control of System or Configuration Setting","timeline":[{"lang":"en","time":"2026-02-02T21:05:20.978Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-02T07:12:31.172Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-06-02T12:20:08.030702Z","id":"CVE-2026-1784","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-02T12:20:25.547Z"}},{"title":"ose-cluster-ingress-operator: Remote Code Execution Through HAProxy Configuration Injection","descriptions":[{"lang":"en","value":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781123014","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-cluster-ingress-operator","defaultStatus":"affected","versions":[{"version":"1781870101","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1781928857","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780962617","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780988280","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780043338","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780990977","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-cluster-ingress-rhel9-operator","defaultStatus":"affected","versions":[{"version":"1780444348","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-1784","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436075","name":"RHBZ#2436075","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26543","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28893","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25045","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25182","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25194","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23241","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-15","description":"External Control of System or Configuration Setting","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-09-10T12:04:50.395Z"},"datePublic":"2026-06-02T07:12:31.172Z","solutions":[{"lang":"en","value":"RHSA-2026:26543: Red Hat OpenShift Container Platform 4.13"},{"lang":"en","value":"RHSA-2026:28893: Red Hat OpenShift Container Platform 4.14"},{"lang":"en","value":"RHSA-2026:28964: Red Hat OpenShift Container Platform 4.15"},{"lang":"en","value":"RHSA-2026:25045: Red Hat OpenShift Container Platform 4.16"},{"lang":"en","value":"RHSA-2026:25182: Red Hat OpenShift Container Platform 4.18"},{"lang":"en","value":"RHSA-2026:23246: Red Hat OpenShift Container Platform 4.19"},{"lang":"en","value":"RHSA-2026:25194: Red Hat OpenShift Container Platform 4.20"},{"lang":"en","value":"RHSA-2026:23241: Red Hat OpenShift Container Platform 4.21"}],"timeline":[{"lang":"en","time":"2026-02-02T21:05:20.978Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-06-02T07:12:31.172Z","value":"Made public."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}