CVE-2026-94572

EUVD-2026-84118
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
mitreCNA
9.4 CRITICAL
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base Score
CVSS 3.x
EPSS Score
Percentile: 45.25%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
openstackoctavia
6.0.0 ≤
𝑥
< 16.1.0
CNA
openstackoctavia
17.0.0 ≤
𝑥
< 17.0.1
CNA
openstackoctavia
18.0.0 ≤
𝑥
< 18.0.1
CNA
Debian logo
Debian Releases
Debian Product
Codename
octavia
bookworm
postponed
forky
19.0.0-10
fixed
sid
19.0.0-10
fixed
trixie
no-dsa
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
octavia
focal
needs-triage
jammy
Fixed in 1:10.1.1-0ubuntu1.5
released
noble
Fixed in 1:14.0.0-0ubuntu1.6
released
resolute
Fixed in 1:18.0.0-0ubuntu2.1
released
stonking
not-affected
Common Weakness Enumeration
References
https://bugs.debian.org/1148175
https://bugs.launchpad.net/octavia/+bug/2162101
https://bugs.launchpad.net/octavia/+bug/2167565
https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d
https://openwall.com/lists/oss-security/2026/09/21/6
https://security.openstack.org/ossa/OSSA-2026-039.html
https://bugs.launchpad.net/octavia/+bug/2162101