CVE-2026-1784

HIGH

Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

Title source: cna

Description

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

References (11)

Core 11

Core References

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-1784

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2436075

https://bugzilla.redhat.com/show_bug.cgi?id=2436075

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:23241

https://access.redhat.com/errata/RHSA-2026:23241

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25045

https://access.redhat.com/errata/RHSA-2026:25045

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25182

https://access.redhat.com/errata/RHSA-2026:25182

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:25194

https://access.redhat.com/errata/RHSA-2026:25194

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:26543

https://access.redhat.com/errata/RHSA-2026:26543

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:23246

https://access.redhat.com/errata/RHSA-2026:23246

Vendor Advisory

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:28964

https://access.redhat.com/errata/RHSA-2026:28964

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:28893

https://access.redhat.com/errata/RHSA-2026:28893

Scores

CVSS v3 8.8

EPSS 0.0019

EPSS Percentile 9.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-15

Status published

Products (11)

Red Hat/Red Hat OpenShift Container Platform 4

Red Hat/Red Hat OpenShift Container Platform 4.13 1781123014

Red Hat/Red Hat OpenShift Container Platform 4.14 1781870101

Red Hat/Red Hat OpenShift Container Platform 4.15 1781928857

Red Hat/Red Hat OpenShift Container Platform 4.16 1780962617

Red Hat/Red Hat OpenShift Container Platform 4.18 1780988280

Red Hat/Red Hat OpenShift Container Platform 4.19 1780043338

Red Hat/Red Hat OpenShift Container Platform 4.2 1780990977

Red Hat/Red Hat OpenShift Container Platform 4.20 1780990977

Red Hat/Red Hat OpenShift Container Platform 4.21 1780444348

... and 1 more

Published Jun 02, 2026

Tracked Since Jun 02, 2026