Introduction
Insufficient input validation in the OpenShift Route API allows any user with Route creation privileges to inject arbitrary HAProxy configuration directives. That gives them indirect control over the ingress layer, which governs all external traffic to OpenShift applications. CVE-2026-1784 has a CVSS score of 8.8, and the barrier to exploitation is low because Route creation is commonly delegated to developers in multi-tenant clusters. For organizations running Red Hat OpenShift with HAProxy ingress, it is a meaningful risk.
Technical Information
How OpenShift Routes Become HAProxy Configuration
In OpenShift, a Route object is the primary mechanism for exposing services to external traffic. The OpenShift router, which runs on HAProxy, watches for Route API objects and dynamically regenerates the HAProxy configuration file at /var/lib/haproxy/conf/haproxy.config. The spec.path field in a Route document sets a URL path for path-based routing, so multiple services can share a single hostname, with traffic separated by path prefix.
The Root Cause: CWE-15
CVE-2026-1784 is classified under CWE-15 (External Control of System or Configuration Setting). MITRE defines this weakness as one where "allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways." The validation checks on the spec.path field were insufficient. Whoever creates or modifies the Route controls the contents of this field, and those contents flow into the HAProxy configuration generation process without adequate sanitization. A carefully crafted spec.path value can therefore break out of its intended context in the HAProxy configuration and inject arbitrary directives.
Attack Flow
The exploitation path is straightforward for anyone with Route creation privileges:
-
The attacker creates or modifies an OpenShift Route object and embeds HAProxy configuration syntax in the
spec.pathfield. Becausespec.pathis a legitimate field that developers set routinely, this needs no special permissions beyond standard Route management. -
The insufficient checks on
spec.pathfail to detect or strip the embedded HAProxy directives, and the malicious payload passes through to the configuration generation pipeline. -
The OpenShift router regenerates
/var/lib/haproxy/conf/haproxy.configwith the injected directives active, and HAProxy reloads with the modified configuration. -
Depending on the injected directives, the attacker could redirect traffic to attacker-controlled endpoints, expose internal services that were never meant to be publicly accessible, or cause denial of service through misconfigured routing rules.
What Makes This Particularly Concerning
This vulnerability pits developer self-service against infrastructure security. OpenShift Routes are designed to give application teams control over how their services are exposed, and spec.path is a core routing attribute that developers legitimately need to change. That makes the field hard to restrict without hurting developer productivity. It also means the vulnerable input is one that gets exercised frequently in normal operations.
The CVSS 8.8 score reflects a network-accessible attack that can compromise both the integrity and the availability of the routing layer. In a multi-tenant OpenShift cluster, a single compromised or malicious namespace could affect routing for every tenant sharing the same HAProxy instance.
Information Gaps
Several important details were still unavailable as of the disclosure date:
| Detail | Status |
|---|---|
| CVSS v3.x vector string | Not yet assigned by NVD |
| Specific injectable HAProxy directives | Not documented publicly |
| Affected OpenShift versions | Not confirmed in any public advisory |
| Proof-of-concept exploit code | Not found in public sources |
| Bugzilla bug 2436075 details | Access restricted |
Affected Systems and Versions
The vulnerability affects Red Hat OpenShift Container Platform deployments that use the default HAProxy-based router for ingress. No public advisory had confirmed specific affected version numbers as of 2026-06-02. The Bugzilla entry (bug 2436075) that would typically list version details remains access-restricted.
A related advisory, RHSA-2026:4434, covers security updates for OpenShift Container Platform 4.19.26, but its relationship to CVE-2026-1784 has not been confirmed. Organizations should not assume that upgrading to 4.19.26 alone resolves this vulnerability without explicit confirmation from Red Hat.
Until Red Hat publishes definitive version guidance, treat any OpenShift deployment where users can create or modify Routes as potentially affected.
Vendor Security History
Red Hat self-reported this vulnerability through its PSIRT ([email protected]), which points to responsible internal discovery. Red Hat follows a defined vulnerability management lifecycle and publishes an annual Product Security Risk Report. The 2025 edition includes vulnerability response statistics and year-over-year comparisons.
Red Hat's own 2026 State of Cloud Native Security Report found that 97% of organisations experienced security incidents in the prior year, and it identified misconfiguration and weak governance as the primary drivers. CVE-2026-1784 fits that finding directly. It is a misconfiguration-class vulnerability in which externally supplied input controls system configuration without adequate validation.
Restricting access to the Bugzilla entry is consistent with Red Hat's standard practice for vulnerabilities under active remediation. It does, however, limit what the wider security community can see during the critical early disclosure period.
References
- NVD Entry for CVE-2026-1784
- Red Hat Security Advisory for CVE-2026-1784
- Red Hat Bugzilla Bug 2436075
- CWE-15: External Control of System or Configuration Setting
- CWE-642: External Control of Critical State Data
- OpenShift Container Platform 4.15: Configuring Routes
- OpenShift Container Platform 4.10: Configuring Routes
- Red Hat Vulnerability Management and Lifecycle
- Red Hat Security Updates and Notifications
- RHSA-2026:4434 Security Advisory
- RHSA-2026:4435 Security Advisory
- Red Hat Product Security Risk Report 2025
- Red Hat 2026 Cloud Native Security Report
- CISA Known Exploited Vulnerabilities Catalog
- Networking Concepts and Routing through HAProxy in OpenShift
