USN-8814-1: Octavia vulnerabilities
Ubuntu patches multiple OpenStack Octavia flaws allowing authenticated load-balancer owners to inject arbitrary HAProxy configuration directives.
Ubuntu Security Notice USN-8814-1 fixes several vulnerabilities in OpenStack Octavia. CVE-2026-94572 stems from improper validation of TLS cipher string fields in the Amphora provider driver, and CVE-2026-94571 from improper validation of L7 policy redirect URL fields; both allow an authenticated attacker who owns a load balancer to inject arbitrary HAProxy configuration directives. A third flaw involves incorrect quality of service policy authorization handling by authenticated attackers. No exploitation is mentioned in the notice.
- Octavia Amphora driver fails to validate TLS cipher and L7 redirect URL fields
- Authenticated load-balancer owners can inject arbitrary HAProxy configuration directives
- QoS policy authorization also handled incorrectly
- Fixed via Ubuntu security notice USN-8814-1
- Organizations
- UbuntuOpenStack Octavia
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-94571 | HAProxy Config Injection via L7 Policy Redirect Fields in OpenStack Octavia | 9.4 | — | ||
| CVE-2026-94572 | HAProxy Config Injection in OpenStack Octavia Amphora Driver via tls_ciphers | 9.4 | — |
From the original article
It was discovered that Octavia did not properly validate TLS cipher string fields in the Amphora provider driver. An authenticated attacker who owns a TLS-enabled load balancer could possibly use this issue to inject arbitrary HAProxy configuration directives. (CVE-2026-94572) It was discovered that Octavia did not properly validate L7 policy redirect URL fields in the Amphora provider driver.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.