Executive brief
Red Hat OpenShift contains a vulnerability in how it handles network routing configurations. An attacker with basic access to the system can inject malicious instructions into the HAProxy configuration, which manages how traffic is directed to different applications. This could allow an attacker to bypass security controls, access sensitive data from other users, or disrupt the availability of services running on the platform.
Technical details
A configuration injection vulnerability exists in Red Hat OpenShift's Route resource. The application performs insufficient validation on the 'spec.path' YAML stanza within Route documents. A local attacker with low privileges can exploit this by crafting a malicious path string that injects arbitrary directives into the underlying HAProxy configuration. Because the vulnerability has a 'Scope: Changed' (S:C) designation in its CVSS vector, an exploit can impact components beyond the immediate OpenShift Route resource, potentially allowing for unauthorized access to other pods' traffic, data exfiltration, or denial of service. This is classified as CWE-15 (External Control of System or Configuration Setting).
Affected products
- Red Hat OpenShift
Timeline
- 2026-06-02: disclosed: Initial publication of CVE-2026-1784