Skip to content
Fencer Vulns
high 7.4

CVE-2026-108334 json

Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides

published 2026-10-15 24 d ago modified 2026-11-05 4 d ago also EUVD-2026-102322

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

Patch / fix

  • Red Hat Red Hat Connectivity Link 1.4 1791975888
  • Red Hat Red Hat Connectivity Link 1.5 1792512519

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-108334 updated cvss 7.4

github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: Crafted HTTPRoute match values can bypass Gateway po

  • Red Hat Connectivity Link 1.4 rhcl-1/rhcl-rhel9-operator 1791975888
    fixed: vendor fix RHSA-2026:83531
  • Red Hat Connectivity Link 1.5 rhcl-1/rhcl-rhel9-operator 1792512519
    fixed: vendor fix RHSA-2026:88203
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-operator-bundle, rhcl-1/developer-portal-controller-rhel9 Red Hat Connectivity Link 1.4 rhcl-1/wasm-shim-rhel9 1791865387, rhcl-1/rhcl-operator-bundle 1791977664, rhcl-1/rhcl-console-plugin-rhel9 1790397254, rhcl-1/rhcl-console-plugin-rhel9 1791215923, rhcl-1/developer-portal-controller-rhel9 1791215928 Red Hat Connectivity Link 1.5 rhcl-1/wasm-shim-rhel9 1792456219, rhcl-1/rhcl-operator-bundle 1792513776, rhcl-1/rhcl-console-plugin-rhel9 1790608789, rhcl-1/rhcl-console-plugin-rhel9 1791370345, rhcl-1/rhcl-console-plugin-rhel9 1791815242, rhcl-1/developer-portal-controller-rhel9 1792214622 Red Hat OpenShift AI (RHOAI) rhoai/odh-model-controller-rhel9, rhoai/odh-model-serving-api-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
24 d ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Affected products

  • Red Hat Red Hat Connectivity Link 1.4
  • Red Hat Red Hat Connectivity Link 1.5
  • Red Hat Red Hat Connectivity Link 1
  • Red Hat Red Hat OpenShift AI (RHOAI)

Classification

Weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.