CVE-2026-94571

A flaw was found in OpenStack Octavia. An authenticated user who can create or update L7 policies on their own load balancer can inject arbitrary HAProxy configuration directives through the redirecturl or redirectprefix fields. The URL validator does not reject control characters such as tabs an...

CVE-2026-94572

A flaw was found in OpenStack Octavia. The tlsciphers field on listeners and pools does not reject control characters or spaces. An authenticated project member can embed extra text in that field so that HAProxy treats it as additional configuration rather than a cipher list. This can change...

Linux Distros Unpatched Vulnerability : CVE-2026-94572

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is...

Linux Distros Unpatched Vulnerability : CVE-2026-94571

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RF...

DEBIAN-CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

DEBIAN-CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

UBUNTU-CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

UBUNTU-CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94572

In OpenStack Octavia before 18.0.1 , the Amphora provider driver failed to validate the tls_ciphers field on listener and pool objects for control characters. The unvalidated value is written verbatim into the HAProxy configuration generated on the amphora, allowing an authenticated project membe...

CVE-2026-94572

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

EUVD-2026-84118

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tlsciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled lo...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

CVE-2026-94571

OpenStack Octavia versions before 18.0.1 are affected when using the Amphora provider driver . The root cause is that the RFC 3986 URL validator percent-encodes control characters before structural validation, allowing newlines to pass checks, yet Octavia writes the raw unencoded value directly i...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...

CVE-2026-94571

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirecturl and redirectprefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored...