{"id":"CVE-2026-1784","aliases":["EUVD-2026-33883","GHSA-qmrp-jx57-5mr7"],"status":"published","title":"Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00194,"percentile":0.09135,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-15"],"published":"2026-06-02T07:22:26Z","modified":"2026-10-01T17:17:22Z","products":[{"vendor":"red hat","product":"red hat openshift container platform 4.12"},{"vendor":"red hat","product":"red hat openshift container platform 4.13"},{"vendor":"red hat","product":"red hat openshift container platform 4.14"},{"vendor":"red hat","product":"red hat openshift container platform 4.15"},{"vendor":"red hat","product":"red hat openshift container platform 4.16"},{"vendor":"red hat","product":"red hat openshift container platform 4.18"},{"vendor":"red hat","product":"red hat openshift container platform 4.19"},{"vendor":"red hat","product":"red hat openshift container platform 4.20"},{"vendor":"red hat","product":"red hat openshift container platform 4.21"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:23241","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:23246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25045","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25182","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25194","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26543","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28893","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28964","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:70647","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1784","tags":["vdb-entry","x_refsource_REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2436075","tags":["issue-tracking","x_refsource_REDHAT","Issue Tracking","Vendor Advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1784.json","tags":["x_sadp-csaf-vex"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1784"},{"url":"https://github.com/advisories/GHSA-qmrp-jx57-5mr7"}],"sources":{"cve":[{"id":"CVE-2026-1784","title":"Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","status":"published","published":"2026-06-02T07:22:26.461Z","modified":"2026-10-01T16:33:32.87Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-15","CWE-15"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-33883","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","status":"published","published":"2026-06-02T07:22:26Z","modified":"2026-10-01T16:33:32Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-qmrp-jx57-5mr7","title":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain...","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","status":"published","published":"2026-06-02T09:36:15Z","modified":"2026-07-02T00:32:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-15"],"updated_at":"2026-11-02T15:09:10.929571Z"}],"nvd":[{"id":"CVE-2026-1784","description":"The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.","status":"published","published":"2026-06-02T09:16:15.683Z","modified":"2026-10-01T17:17:22.817Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-15"],"updated_at":"2026-11-02T14:12:22.022466Z"}]}}