Read the docs
TI-2026-71267 Aliases CVE-2026-109575GHSA-7jqw-rhp8-c8vf

Missing authentication in HAProxy Data Plane API management listeners

Priority MEDIUM 49CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

HAProxy Data Plane API from 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) is affected. When tls_ca and a numeric tls_port are configured, Basic authentication is disabled globally on a handler shared by all listeners, so non-mTLS listeners accept unauthenticated requests. This is missing authentication for a critical function (CWE-306). An unauthenticated attacker who can reach an HTTP or UNIX endpoint can read or replace the managed configuration.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HAProxyData Plane API EE2.2.0-ee1 – 2.9.28-ee1; 3.0-ee – 3.0.24-ee1; 3.1-ee – 3.2.16-ee1; 3.3-ee – 3.3.8-ee1; 3.4-ee – 3.4.3-ee2—No fix listedCNA
HAProxyData Plane API CE2.2.0 – 2.9.28; 3.0.0 – 3.0.24; 3.1.0 – 3.2.16; 3.3.0 – 3.3.8; 3.4.0 – 3.4.3—No fix listedCNA
  • Data Plane API EE VendorHAProxy Affected 2.2.0-ee1 – 2.9.28-ee1; 3.0-ee – 3.0.24-ee1; 3.1-ee – 3.2.16-ee1; 3.3-ee – 3.3.8-ee1; 3.4-ee – 3.4.3-ee2 Fixed in — No fix listed CNA
  • Data Plane API CE VendorHAProxy Affected 2.2.0 – 2.9.28; 3.0.0 – 3.0.24; 3.1.0 – 3.2.16; 3.3.0 – 3.3.8; 3.4.0 – 3.4.3 Fixed in — No fix listed CNA

Remediation

Upgrade Data Plane API to 3.4.4, 3.3.9, 3.2.17, 3.0.25 or 2.9.29, depending on the release branch in use. Enterprise Edition users should apply the respective EE backports of these fixes.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-109575
  2. 2026-10-13 Alias added: GHSA-7jqw-rhp8-c8vf
  3. 2026-10-13 CISA SSVC decision points changed

References

Other 4

  • TI-2020-08973 In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before… CVSS 3.1HIGH 8.8
  • TI-2023-21094 HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23… CVSS 3.1HIGH 7.2
  • TI-2019-10602 HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via… CVSS 3.0HIGH 7.5
  • TI-2021-17418 An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be… CVSS 3.1HIGH 7.5
  • TI-2016-04651 HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote… CVSS 3.0HIGH 7.5
  • TI-2026-25946 An issue was discovered in HAProxy before 3.3.6. CVSS 3.1MEDIUM 5.8
See all 42 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences