Octavia (Product): news timeline & CVEs

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)

OpenStack Octavia advisory warns HAProxy config injection can lead to remote code execution.

OpenStack published OSSA-2026-039, dated 21 September 2026, warning that HAProxy configuration injection in Octavia can lead to remote code execution. The issue is tracked as CVE-2026-94572 and CVE-2026-94571. Affected versions are Octavia 0.8.0 through releases before 16.1.0, as well as 17.0.0 and 18.0.0. The published excerpt does not say the flaw is being exploited.

oss-securityupdated Sep 24, 12:38 UTC · 2d agofirst Sep 22, 15:59 UTC · 4d agoVulnerability 3 sources CVE-2026-94572 CVE-2026-94571

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)

OpenStack Octavia advisory warns HAProxy configuration injection can lead to remote code execution.

OpenStack Security Advisory OSSA-2026-039, dated 21 September 2026, describes HAProxy configuration injection that can lead to remote code execution in Octavia. Affected releases are Octavia 0.8.0 up to but not including 16.1.0, as well as 17.0.0 and 18.0.0. The notice lists the issue as CVE-2026-pending, and the posted text does not report observed exploitation.

oss-securityupdated Sep 24, 12:38 UTC · 2d agofirst Sep 21, 17:18 UTC · 5d agoVulnerability 3 sources

Octavia

Timeline2 articles

Related CVEsby mentions

Appears with

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571)

[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending)