OpenStack Octavia <18.0.1 Amphora TLS Cipher Injection (HAProxy Config)
CVE-2026-94572 Published on September 21, 2026
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Vulnerability Analysis
CVE-2026-94572 is exploitable with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is a Code Injection Vulnerability?
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2026-94572 has been classified to as a Code Injection vulnerability or weakness.
Products Associated with CVE-2026-94572
Want to know whenever a new CVE is published for OpenStack Octavia? stack.watch will email you.
Affected Versions
OpenStack Octavia:- Version 6.0.0 and below 16.1.0 is affected.
- Version 17.0.0 and below 17.0.1 is affected.
- Version 18.0.0 and below 18.0.1 is affected.