CVE-2026-94572
published 2026-09-21CVE-2026-94572: In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is…
PriorityP356critical9.4CVSS 4.0
AVNACLATNPRLUINVCHVIHVAHSCHSIHSAHEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.53%
44.3th percentile
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | octavia | >= 17.0.0 < 17.0.1 | 17.0.1 |
| openstack | octavia | >= 18.0.0 < 18.0.1 | 18.0.1 |
| openstack | octavia | >= 6.0.0 < 16.1.0 | 16.1.0 |
| ubuntu | octavia | — | — |
CVSS provenance
nvdv4.09.4CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat9.4CRITICAL
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Octavia vulnerabilities
vendor_ubuntu·2026-09-24·CVSS 4.3
CVE-2026-94571 [MEDIUM] Octavia vulnerabilities
Title: Octavia vulnerabilities
Summary: Several security issues were fixed in Octavia.
It was discovered that Octavia did not properly validate TLS cipher
string fields in the Amphora provider driver. An authenticated
attacker who owns a TLS-enabled load balancer could possibly use
this issue to inject arbitrary HAProxy configuration directives.
(CVE-2026-94572)
It was discovered that Octavia did not properly validate L7 policy
redirect URL fields in the Amphora provider driver. An authenticated
attacker who owns a load balancer could possibly use this issue to
inject arbitrary HAProxy configuration directives. (CVE-2026-94571)
It was discovered that Octavia incorrectly handled quality of service
policy authorization. An authenticated attacker could possibly use
this issue to prevent d
Red Hat
openstack-octavia: octavia: HAProxy configuration injection via tls_ciphers on pools and listeners
vendor_redhat·2026-09-21·CVSS 9.4
CVE-2026-94572 [CRITICAL] CWE-94 openstack-octavia: octavia: HAProxy configuration injection via tls_ciphers on pools and listeners
openstack-octavia: octavia: HAProxy configuration injection via tls_ciphers on pools and listeners
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
A flaw was found in OpenStack Octavia. The tls_ciphers field on listeners and pools does not reject control characters or spaces. An authenticated project member can embed extra text in that field so that HAProxy treats it as additional configuration rathe
GHSA
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters.
ghsa_unreviewed·2026-09-21
CVE-2026-94572 [CRITICAL] CWE-94 In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters.
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
VulDB
OpenStack Octavia up to 16.0.x/17.0.0/18.0.0 Amphora provider driver tls_ciphers injection
vuldb·2026-09-21·CVSS 9.4
CVE-2026-94572 [CRITICAL] OpenStack Octavia up to 16.0.x/17.0.0/18.0.0 Amphora provider driver tls_ciphers injection
A vulnerability, which was classified as very critical, was found in OpenStack Octavia up to 16.0.x/17.0.0/18.0.0. This affects an unknown part of the component Amphora provider driver. Executing a manipulation of the argument tls_ciphers can lead to injection.
This vulnerability is handled as CVE-2026-94572. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://bugs.debian.org/1148175https://bugs.launchpad.net/octavia/+bug/2162101https://bugs.launchpad.net/octavia/+bug/2167565https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599dhttps://openwall.com/lists/oss-security/2026/09/21/6https://security.openstack.org/ossa/OSSA-2026-039.htmlhttps://bugs.launchpad.net/octavia/+bug/2162101
2026-09-21
Published