← CVE Intelligence

CVE-2026-1784

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection PUBLISHED

Description (CNA)

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1789911929 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1781123014 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1781870101 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1781928857 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 1780962617 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 1780988280 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 1780043338 before *
Red Hat / Red Hat OpenShift Container Platform 4.20unaffected 1780990977 before *
Red Hat / Red Hat OpenShift Container Platform 4.21unaffected 1780444348 before *

CWE

CWE-15

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.