CVE-2026-94572: Code Injection
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Octavia Amphora provider driverto a version that resolves this vulnerability.Fixed in 18.0.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only OpenStack Octavia deployments using the Amphora provider are affected. The issue applies to versions before 18.0.1.
What level of access does an attacker need?
An attacker must be an authenticated project member and must own a TLS-enabled load balancer. They need to supply control characters, such as a newline, through a listener or pool tls_ciphers value.
What can a successful exploit do?
A successful exploit can inject arbitrary HAProxy configuration directives into the configuration generated on the amphora.
How can I determine whether a load balancer may be affected?
Check whether the deployment uses the Amphora provider and whether listener or pool tls_ciphers values contain control characters. TLS-enabled load balancers owned by project members are the relevant exposure path.