TI-2026-63467 Aliases CVE-2026-94572 GHSA-xwpf-r3rp-gx2r

Code injection in OpenStack Octavia

HIGH 76CWE-94Published 2026-09-21 · Updated 2026-09-24

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-94.

Summary

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00534 45th percentileScored 2026-11-07

Fix Partial Octavia (OpenStack): 16.1.0, 17.0.1, 18.0.1Red Hat: 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenStack	Octavia	6.0.0 to before 16.1.0; 17.0.0 to before 17.0.1; 18.0.0 to before 18.0.1	16.1.0, 17.0.1, 18.0.1	Patch available	CNA

Octavia VendorOpenStack Affected 6.0.0 to before 16.1.0; 17.0.0 to before 17.0.1; 18.0.0 to before 18.0.1 Fixed in 16.1.0, 17.0.1, 18.0.1 Patch available CNA

Remediation

Fix · CNA Octavia (OpenStack) Fixed in 16.1.0, 17.0.1, 18.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2026-09-21
OpenStack Octavia — security.openstack.org/ossa/OSSA-2026-039.html
2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-63466 Code injection in OpenStack OctaviaPriority MEDIUM 43
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 13 (Queens)	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 16.2	Affected	No fix planned: Will not fix
Red Hat OpenStack Platform 17.1	Affected	No fix yet
Red Hat OpenStack Platform 18.0	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2026-94572
2026-10-03 Alias added: GHSA-xwpf-r3rp-gx2r

References

Patch 1

https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d

Advisory 1

https://security.openstack.org/ossa/OSSA-2026-039.html

Other 4

TI-2026-78562 Incorrect authorization in OpenStack Manila share operations CVSS 3.1CRITICAL 9.9
TI-2017-13226 The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before… CVSS 3.1CRITICAL 9.8
TI-2026-69629 OpenStack Mistral flaw lets users change other projects' resources CVSS 4.0HIGH 7.2
TI-2026-69623 Command injection in OpenStack Mistral std.ssh_proxied action CVSS 4.0HIGH 8.7
TI-2022-17779 Improper privilege management in OpenStack CVSS 3.1HIGH 8.8
TI-2026-37300 Resource allocation without limits in OpenStack Ironic CVSS 3.1HIGH 7.5

See all 332 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences