CVE-2026-94572 Code injection in Octavia
Authenticated users can inject HAProxy directives via TLS ciphers in OpenStack Octavia Amphora deployments, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-94572?
CVE-2026-94572 is a critical code injection vulnerability in OpenStack Octavia, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.
Weakness: CWE-94
Which versions are affected by CVE-2026-94572?
How do I fix CVE-2026-94572?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-94572 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94572 exists.
Sources
Also known as DEBIAN-CVE-2026-94572, GHSA-xwpf-r3rp-gx2r, UBUNTU-CVE-2026-94572.