CVE-2026-94571
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| mitreCNA (assigner) | 4.0 | Critical9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| NVDNVD · Awaiting Analysis | 4.0 | Critical9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (5 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.
Weakness
Affected products
References (6)
- https://bugs.launchpad.net/octavia/+bug/2162103 (opens in a new tab)issue-tracking
- https://bugs.launchpad.net/octavia/+bug/2167565 (opens in a new tab)issue-tracking
- https://bugs.debian.org/1148175 (opens in a new tab)issue-tracking
- https://opendev.org/openstack/octavia/commit/bad7074621562d90a38be4639c1ab3e245f5bf39 (opens in a new tab)patch
- https://security.openstack.org/ossa/OSSA-2026-039.html (opens in a new tab)vendor-advisory
- https://openwall.com/lists/oss-security/2026/09/21/6 (opens in a new tab)mailing-list
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-94571)Record last updated .