Skip to content
Fencer Vulns
critical 9.4

CVE-2026-94571 json

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirec…

published 2026-09-21 48 d ago modified 2026-09-22 47 d ago also EUVD-2026-84116

cvss
9.4
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

Patch / fix

  • OpenStack Octavia 16.1.0, 17.0.1, 18.0.1
  • octavia Debian 14 18.0.0-4

debian advisories DEBIAN-CVE-2026-94571

  • octavia Ubuntu 22.04 LTS 1:10.1.1-0ubuntu1.5
  • octavia Ubuntu 24.04 LTS 1:14.0.0-0ubuntu1.6
  • octavia Ubuntu 26.04 LTS 1:18.0.0-0ubuntu2.1

ubuntu advisories UBUNTU-CVE-2026-94571

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-94571 updated cvss 5.0

openstack-octavia: octavia: HAProxy configuration injection via L7 policy redirect_url and redirect_prefix

  • Red Hat OpenStack Platform 13 (Queens) python-octavia, openstack-octavia, openstack-octavia-api, openstack-octavia-common, openstack-octavia-worker, python-octavia-tests-golang, +4 more Red Hat OpenStack Platform 16.2 python3-octavia, openstack-octavia-api, openstack-octavia-common, openstack-octavia-worker, openstack-octavia-housekeeping, openstack-octavia-amphora-agent, +2 more
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenStack Platform 17.1 python3-octavia, openstack-octavia-api, openstack-octavia-common, openstack-octavia-worker, openstack-octavia-housekeeping, openstack-octavia-amphora-agent, +2 more Red Hat OpenStack Platform 18.0 openstack-octavia
    affected: workaround, no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
47 d ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • OpenStack Octavia

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.