CVE-2026-94571

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-94571
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94571.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-94571
Downstream
Published
2026-09-21T20:09:16Z
Modified
2026-09-22T11:46:09Z
Severity
  • 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
[none]
Details

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

Database specific 
{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-94"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94571.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "17.0.0"
                },
                {
                    "fixed":  "17.0.1"
                },
                {
                    "introduced":  "18.0.0"
                },
                {
                    "fixed":  "18.0.1"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / opendev.org/openstack/octavia

Affected ranges

Type
GIT
Repo
https://opendev.org/openstack/octavia
Events
Introduced
ecfca348904560c341e84644137b9c0aa09b3949
Fixed
9994bc7d4bc51771fd24384f8e5edb480063d929
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.8.0"
        },
        {
            "fixed":  "16.1.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.10.0
0.8.0
0.9.0
1.*
1.0.0.0b1
1.0.0.0b2
1.0.0.0b3
1.0.0.0rc1
10.*
10.0.0
10.0.0.0rc1
11.*
11.0.0
11.0.0.0rc1
12.*
12.0.0.0rc1
13.*
13.0.0
13.0.0.0rc1
14.*
14.0.0
14.0.0.0rc1
15.*
15.0.0
15.0.0.0rc1
16.*
16.0.0
16.0.0.0rc1
16.0.0.0rc2
16.0.1
2.*
2.0.0.0b1
2.0.0.0b2
2.0.0.0b3
2.0.0.0rc1
3.*
3.0.0.0b1
3.0.0.0b2
3.0.0.0b3
3.0.0.0rc1
4.*
4.0.0.0rc1
5.*
5.0.0.0rc1
6.*
6.0.0
6.0.0.0rc1
7.*
7.0.0
7.0.0.0rc1
8.*
8.0.0.0rc1
9.*
9.0.0
9.0.0.0rc1
Other
ocata-em

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-94571.json"