CVE-2026-1784 Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

What is CVE-2026-1784?

CVE-2026-1784 is a high-severity code injection vulnerability in Redhat Openshift Container Platform, published on 2 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

Weakness: CWE-15

Which versions are affected by CVE-2026-1784?

It affects 1 product.

Products include Redhat Openshift Container Platform.

How do I fix CVE-2026-1784?

No fix has been published for CVE-2026-1784 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-1784 being exploited?

There is no known exploitation of CVE-2026-1784 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift Container Platform

• CVE-2020-27836 Missing authorization in cluster-ingress-operator Critical 9.8
• CVE-2018-1085 Misconfiguration in openshift-ansible Critical 9.0
• CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4 High 8.8
• CVE-2021-20182 Privilege escalation in openshift High 8.8
• CVE-2019-0542 xterm vulnerable to remote code execution High 8.8

All Redhat Openshift Container Platform vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qmrp-jx57-5mr7.