In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECTTOURL L7 policy. Only deployments using the Amphora provider are affected.
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Last updated 19 August 2026
==================================================== OSSA-2026-035: Unauthorized QoS policy deletion lock ====================================================
:Date: August 13, 2026 :CVE: PENDING
Affects ~~~~~~~ - Octavia: <16.0.2, ==17.0.0, ==18.0.0
Description ~~~~~~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/1000296 (2025.1/epoxy) - https://review.opendev.org/1000295 (2025.2/flamingo) - https://review.opendev.org/1000094 (2026.1/gazpacho) - https://review.opendev.org/998935 (2026.2/hibiscus (development))
Credits ~~~~~~~ - Chen YuXiang from Institute of Computing Technology, Chinese Academy of Sciences
References ~~~~~~~~~~ - https://launchpad.net/bugs/2161500
Notes ~~~~~ - A CVE assignment was requested from MITRE on 2026-08-05 (request 2079027); this advisory will be updated with the ID in an errata publication once it becomes available.
-- Jeremy Stanley OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
==================================================== OSSA-2026-035: Unauthorized QoS policy deletion lock ====================================================
:Date: August 13, 2026 :CVE: CVE-2026-74248
Affects ~~~~~~~ - Octavia: <16.0.2, ==17.0.0, ==18.0.0
Description ~~~~~~~~~~~ Errata ~~~~~~ MITRE assigned CVE-2026-74248 after intial publication.
Patches ~~~~~~~ - https://review.opendev.org/1000296 (2025.1/epoxy) - https://review.opendev.org/1000295 (2025.2/flamingo) - https://review.opendev.org/1000094 (2026.1/gazpacho) - https://review.opendev.org/998935 (2026.2/hibiscus (development))
Credits ~~~~~~~ References ~~~~~~~~~~ - https://launchpad.net/bugs/2161500 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-74248
OSSA History ~~~~~~~~~~~~ - 2026-08-17 - Errata 1 - 2026-08-13 - Original Version
-- Jeremy Stanley OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
========================================================================================== ==========================================================================================
:Date: September 21, 2026 :CVE: CVE-2026-94572, CVE-2026-94571
Affects ~~~~~~~ - Octavia: >=0.8.0 <16.1.0, ==17.0.0, ==18.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported input validation flaws in the Octavia load balancer API. The listener and pool tlsciphers fields and the L7 policy redirecturl and redirectprefix fields were written into the HAProxy configuration generated on the amphora without rejecting control characters, allowing an authenticated user who owns a load balancer managed by OpenStack Octavia's Amphora provider to inject arbitrary HAProxy configuration directives.
Subsequently, an independent reporter, "Rolix", demonstrated that these flaws can be exploited to execute arbitrary commands as root on the provider-managed amphora, to disclose other tenants' TLS private keys and certificates and the deployment heartbeat key stored on the amphora, and to reach the control-plane network to which the amphora is attached.
Only the Amphora provider driver is affected. Deployments that use a different provider driver do not render tenant input into an HAProxy configuration and are not affected.
Errata ~~~~~~ Patches ~~~~~~~ - https://review.opendev.org/1001096 (2025.1/epoxy) - https://review.opendev.org/1001097 (2025.1/epoxy) - https://review.opendev.org/1001094 (2025.2/flamingo) - https://review.opendev.org/1001095 (2025.2/flamingo) - https://review.opendev.org/1001091 (2026.1/gazpacho) - https://review.opendev.org/1001092 (2026.1/gazpacho) - https://review.opendev.org/999553 (2026.2/hibiscus) - https://review.opendev.org/999555 (2026.2/hibiscus)
Credits ~~~~~~~ - "Rolix" from Independent (CVE-2026-94572)
References ~~~~~~~~~~ - https://launchpad.net/bugs/2167565 - https://launchpad.net/bugs/2162101 - https://launchpad.net/bugs/2162103 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94572 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-94571
Notes ~~~~~ - Two changes are required on each branch: one fixes the tlsciphers fields and one fixes the L7 policy redirect fields. - The listener and pool tlsciphers fields were introduced in Octavia 6.0.0. Releases within the affected range that predate 6.0.0 are vulnerable only through the L7 policy redirecturl and redirectprefix fields. - These issues were originally triaged as a low-severity hardening opportunity and the fixes were developed and merged in public. They were reclassified after a proof of concept demonstrated remote code execution as root on the amphora and reachability of the control-plane network. - The remote code execution issue was reported to the OpenStack VMT by Thomas Goirand (zigo) of Infomaniak, on behalf of the reporter, "Rolix".
OSSA History ~~~~~~~~~~~~ - 2026-09-21 - Errata 1 - 2026-09-21 - Original Version
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html
On 9/21/26 10:08 AM, Goutham Pacha Ravi wrote: ========================================================================================== ==========================================================================================
:Date: September 21, 2026 :CVE: CVE-2026-pending, CVE-2026-pending
Affects ~~~~~~~ - Octavia: >=0.8.0 <16.1.0, ==17.0.0, ==18.0.0
Description ~~~~~~~~~~~ Chen YuXiang from the Institute of Computing Technology, Chinese Academy of Sciences reported input validation flaws in the Octavia load balancer API. The listener and pool tlsciphers fields and the L7 policy redirecturl and redirectprefix fields were written into the HAProxy configuration generated on the amphora without rejecting control characters, allowing an authenticated user who owns a load balancer managed by OpenStack Octavia's Amphora provider to inject arbitrary HAProxy configuration directives.
Subsequently, an independent reporter, "Rolix", demonstrated that these flaws can be exploited to execute arbitrary commands as root on the provider-managed amphora, to disclose other tenants' TLS private keys and certificates and the deployment heartbeat key stored on the amphora, and to reach the control-plane network to which the amphora is attached.
Only the Amphora provider driver is affected. Deployments that use a different provider driver do not render tenant input into an HAProxy configuration and are not affected.
Patches ~~~~~~~ - https://review.opendev.org/1001096 (2025.1/epoxy) - https://review.opendev.org/1001097 (2025.1/epoxy) - https://review.opendev.org/1001094 (2025.2/flamingo) - https://review.opendev.org/1001095 (2025.2/flamingo) - https://review.opendev.org/1001091 (2026.1/gazpacho) - https://review.opendev.org/1001092 (2026.1/gazpacho) - https://review.opendev.org/999553 (2026.2/hibiscus) - https://review.opendev.org/999555 (2026.2/hibiscus)
Credits ~~~~~~~ - "Rolix" from Independent
References ~~~~~~~~~~ - https://launchpad.net/bugs/2167565 - https://launchpad.net/bugs/2162101 - https://launchpad.net/bugs/2162103 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-pending
Notes ~~~~~ - Two changes are required on each branch: one fixes the tlsciphers fields and one fixes the L7 policy redirect fields. - The listener and pool tlsciphers fields were introduced in Octavia 6.0.0. Releases within the affected range that predate 6.0.0 are vulnerable only through the L7 policy redirecturl and redirectprefix fields. - These issues were originally triaged as a low-severity hardening opportunity and the fixes were developed and merged in public. They were reclassified after a proof of concept demonstrated remote code execution as root on the amphora and reachability of the control-plane network. - The remote code execution issue was reported to the OpenStack VMT by Thomas Goirand (zigo) of Infomaniak, on behalf of the reporter, "Rolix". - CVE identifiers were requested from MITRE for these two vulnerabilities on 2026-09-17. The CVEs will be added to this advisory by errata once assigned.
-- Goutham Pacha Ravi OpenStack Vulnerability Management Team https://security.openstack.org/vmt.html