Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
Priority LOW 39CWE-15Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | 1789911929 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | 1781123014 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | 1781870101 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | 1781928857 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | 1780962617 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | 1780988280 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | 1780043338 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | 1780990977 | Patch available | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | 1780444348 | Patch available | CNA |
- Red Hat OpenShift Container Platform 4.12 VendorRed Hat Affected — Fixed in 1789911929 Patch available CNA
- Red Hat OpenShift Container Platform 4.13 VendorRed Hat Affected — Fixed in 1781123014 Patch available CNA
- Red Hat OpenShift Container Platform 4.14 VendorRed Hat Affected — Fixed in 1781870101 Patch available CNA
- Red Hat OpenShift Container Platform 4.15 VendorRed Hat Affected — Fixed in 1781928857 Patch available CNA
- Red Hat OpenShift Container Platform 4.16 VendorRed Hat Affected — Fixed in 1780962617 Patch available CNA
- Red Hat OpenShift Container Platform 4.18 VendorRed Hat Affected — Fixed in 1780988280 Patch available CNA
- Red Hat OpenShift Container Platform 4.19 VendorRed Hat Affected — Fixed in 1780043338 Patch available CNA
- Red Hat OpenShift Container Platform 4.20 VendorRed Hat Affected — Fixed in 1780990977 Patch available CNA
- Red Hat OpenShift Container Platform 4.21 VendorRed Hat Affected — Fixed in 1780444348 Patch available CNA
Remediation
Red Hat 9 advisories
- RHSA-2026:70647 Released 2026-10-01 · Red Hat rating ImportantOpenShift Container Platform 4.12.99 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
- RHSA-2026:28964 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.15.66 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kube-metrics-server-rhel8 +47
- RHSA-2026:28893 Released 2026-07-01 · Red Hat rating ImportantOpenShift Container Platform 4.14.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 registry.redhat.io/openshift4/cloud-network-config-controller-rhel8, registry.redhat.io/openshift4/egress-router-cni-rhel8, registry.redhat.io/openshift4/kubevirt-csi-driver-rhel8 +47
Show 6 more Red Hat advisories
- RHSA-2026:26543 Released 2026-06-25 · Red Hat rating ImportantOpenShift Container Platform 4.13.68 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 registry.redhat.io/openshift4/ose-cluster-ingress-operator, registry.redhat.io/openshift4/ose-operator-lifecycle-manager
- RHSA-2026:25045 Released 2026-06-17 · Red Hat rating ImportantOpenShift Container Platform 4.16.64 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 registry.redhat.io/openshift4/kube-metrics-server-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator +5
- RHSA-2026:25182 Released 2026-06-17 · Red Hat rating ImportantOpenShift Container Platform 4.18.44 bug fix and security update
- Red Hat OpenShift Container Platform 4.18 registry.redhat.io/openshift4/azure-service-rhel9-operator, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-azure-file-csi-driver-rhel9 +15
- RHSA-2026:25194 Released 2026-06-16 · Red Hat rating ImportantOpenShift Container Platform 4.20.25 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator +9
- RHSA-2026:23241 Released 2026-06-11 · Red Hat rating ImportantOpenShift Container Platform 4.21.19 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-cloud-credential-rhel9-operator, registry.redhat.io/openshift4/ose-cluster-ingress-rhel9-operator, registry.redhat.io/openshift4/ose-haproxy-router-rhel9 +2
- RHSA-2026:23246 Released 2026-06-10 · Red Hat rating ImportantOpenShift Container Platform 4.19.33 bug fix and security update
- Red Hat OpenShift Container Platform 4.19 registry.redhat.io/openshift4/aws-karpenter-provider-aws-rhel9, registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/azure-kms-encryption-provider-rhel9 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2026:70647 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2026:26543 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2026:28893 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2026:28964 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2026:25045 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2026:25182 |
| Red Hat OpenShift Container Platform 4.19 | Fixed | RHSA-2026:23246 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:25194 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:23241 |
Not affected: 9 products
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.18
- Red Hat OpenShift Container Platform 4.19
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
Timeline
- 2026-10-02 Threatist record created from CVE-2026-1784
- 2026-10-03 Alias added: GHSA-qmrp-jx57-5mr7
References
More Red Hat Openshift Container Platform vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
- TI-2026-34021 Linux kernel skb coalescing drops shared-frag marker KEVCVSS 3.1HIGH 7.8
- TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
Sources
- CVE-2026-1784 · CVE Program
- CVE-2026-1784 · NVD
- FIRST EPSS
- GHSA-qmrp-jx57-5mr7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-1784 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences