Riskcovery

CVE-2026-1784

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

State
Published
Severity
8.8 High
Published
Jun 2, 2026
Updated
Oct 1, 2026
Reserved
Feb 2, 2026

Read the record on cve.org

Description

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hredhat
3.18.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hredhat-SADP

Weaknesses

  • CWE-15 External Control of System or Configuration Setting

Affected Products

ProductVersions
Red Hat OpenShift Container Platform 4.12Red Hat
  • 1789911929 and laterNot affected
Red Hat OpenShift Container Platform 4.13Red Hat
  • 1781123014 and laterNot affected
Red Hat OpenShift Container Platform 4.14Red Hat
  • 1781870101 and laterNot affected
Red Hat OpenShift Container Platform 4.15Red Hat
  • 1781928857 and laterNot affected
Red Hat OpenShift Container Platform 4.16Red Hat
  • 1780962617 and laterNot affected
Red Hat OpenShift Container Platform 4.18Red Hat
  • 1780988280 and laterNot affected
Red Hat OpenShift Container Platform 4.19Red Hat
  • 1780043338 and laterNot affected
Red Hat OpenShift Container Platform 4.20Red Hat
  • 1780990977 and laterNot affected
Red Hat OpenShift Container Platform 4.21Red Hat
  • 1780444348 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.