CVE-2026-94571
published 2026-09-21CVE-2026-94571: In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The…
PriorityP358critical9.4CVSS 4.0
AVNACLATNPRLUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.53%
44.3th percentile
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | octavia | >= 0.8.0 < 16.1.0 | 16.1.0 |
| openstack | octavia | >= 17.0.0 < 17.0.1 | 17.0.1 |
| openstack | octavia | >= 18.0.0 < 18.0.1 | 18.0.1 |
| ubuntu | octavia | — | — |
CVSS provenance
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.4CRITICAL
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields.
ghsa_unreviewed·2026-09-21
CVE-2026-94571 [CRITICAL] CWE-94 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields.
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
VulDB
OpenStack Octavia up to 16.0.x/17.0.0/18.0.0 Amphora provider driver redirect_url/redirect_prefix code injection
vuldb·2026-09-21·CVSS 9.4
CVE-2026-94571 [CRITICAL] OpenStack Octavia up to 16.0.x/17.0.0/18.0.0 Amphora provider driver redirect_url/redirect_prefix code injection
A vulnerability has been found in OpenStack Octavia up to 16.0.x/17.0.0/18.0.0 and classified as very critical. This vulnerability affects unknown code of the component Amphora provider driver. The manipulation of the argument redirect_url/redirect_prefix leads to code injection.
This vulnerability is uniquely identified as CVE-2026-94571. The attack is possible to be carried out remotely. No exploit exists.
The affected component should be upgraded.
Ubuntu
Octavia vulnerabilities
vendor_ubuntu·2026-09-24·CVSS 4.3
CVE-2026-94571 [MEDIUM] Octavia vulnerabilities
Title: Octavia vulnerabilities
Summary: Several security issues were fixed in Octavia.
It was discovered that Octavia did not properly validate TLS cipher
string fields in the Amphora provider driver. An authenticated
attacker who owns a TLS-enabled load balancer could possibly use
this issue to inject arbitrary HAProxy configuration directives.
(CVE-2026-94572)
It was discovered that Octavia did not properly validate L7 policy
redirect URL fields in the Amphora provider driver. An authenticated
attacker who owns a load balancer could possibly use this issue to
inject arbitrary HAProxy configuration directives. (CVE-2026-94571)
It was discovered that Octavia incorrectly handled quality of service
policy authorization. An authenticated attacker could possibly use
this issue to prevent d
Red Hat
openstack-octavia: octavia: HAProxy configuration injection via L7 policy redirect_url and redirect_prefix
vendor_redhat·2026-09-21·CVSS 9.4
CVE-2026-94571 [CRITICAL] CWE-94 openstack-octavia: octavia: HAProxy configuration injection via L7 policy redirect_url and redirect_prefix
openstack-octavia: octavia: HAProxy configuration injection via L7 policy redirect_url and redirect_prefix
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
A flaw was found in OpenStack Octavia. An authenticated user who can create or update L7
No detection rules found.
No public exploits indexed.
https://bugs.debian.org/1148175https://bugs.launchpad.net/octavia/+bug/2162103https://bugs.launchpad.net/octavia/+bug/2167565https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39https://openwall.com/lists/oss-security/2026/09/21/6https://security.openstack.org/ossa/OSSA-2026-039.html
2026-09-21
Published