CVE-2026-94571: [OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to mote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECTTOURL L7 policy. Only deployments using the Amphora provider are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/octaviato a version that resolves this vulnerability.Fixed in 18.0.0-4Fixed in 19.0.0~rc1-2 - Upgrade
Upgrade
OpenStack Octaviato a version that resolves this vulnerability.Fixed in 18.0.1
Event History
Frequently Asked Questions
Which Octavia deployments are exposed?
Only deployments using the Amphora provider are affected. Deployments using other provider drivers are not identified as affected by the available information.
What level of access does an attacker need?
An attacker must be an authenticated project member who owns a load balancer. They can exploit the issue through a REDIRECT_TO_URL L7 policy by supplying control characters in redirect_url or redirect_prefix.