Riskcovery

CVE-2026-108334

Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides

State
Published
Severity
7.4 High
Published
Oct 15, 2026
Updated
Oct 23, 2026
Reserved
Oct 9, 2026

Read the record on cve.org

Description

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

Scores

CVSSScoreVectorSource
3.17.4 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Affected Products

ProductVersions
Red Hat Connectivity Link 1.4Red Hat
  • 1791975888 and laterNot affected
Red Hat Connectivity Link 1.5Red Hat
  • 1792512519 and laterNot affected
Red Hat Connectivity Link 1Red Hat
    Red Hat Connectivity Link 1Red Hat
      Red Hat OpenShift AI (RHOAI)Red Hat
        Red Hat OpenShift AI (RHOAI)Red Hat

          References

          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.