CVE-2026-94571: Code Injection
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECTTOURL L7 policy. Only deployments using the Amphora provider are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Octavia (Amphora provider)to a version that resolves this vulnerability.Fixed in 18.0.1 - Compensating control
Only Amphora provider deployments are affected; ensure mitigations/patching are applied specifically to Octavia deployments using the Amphora provider.
Event History
Frequently Asked Questions
Which Octavia deployments are exposed?
Only deployments using the Amphora provider are affected. Deployments using other provider drivers are not identified as affected by the available information.
What level of access does an attacker need?
An attacker must be an authenticated project member who owns a load balancer. They can exploit the issue through a REDIRECT_TO_URL L7 policy by supplying control characters in redirect_url or redirect_prefix.