Log in Start free

Vulnerability · Published Sep 21, 2026 · Assigned by mitre

CVE-2026-94571

Critical 9.4

In plain English

A critical-severity code injection in Octavia from OpenStack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12octaviano fix listedDEBIAN-CVE-2026-94571
Debian:13octaviano fix listedDEBIAN-CVE-2026-94571
Debian:14octavia18.0.0-4DEBIAN-CVE-2026-94571
Ubuntu:22.04:LTSoctavia1:10.1.1-0ubuntu1.5UBUNTU-CVE-2026-94571
Ubuntu:22.04:LTSoctavia1:10.1.1-0ubuntu1.5USN-8814-1
Ubuntu:24.04:LTSoctavia1:14.0.0-0ubuntu1.6USN-8814-1
Ubuntu:24.04:LTSoctavia1:14.0.0-0ubuntu1.6UBUNTU-CVE-2026-94571
Ubuntu:26.04:LTSoctavia1:18.0.0-0ubuntu2.1USN-8814-1
Ubuntu:26.04:LTSoctavia1:18.0.0-0ubuntu2.1UBUNTU-CVE-2026-94571

Affected products (as reported)

VendorProductVersions
OpenStack Octavia 0.8.0 – before 16.1.017.0.0 – before 17.0.118.0.0 – before 18.0.1

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References