Quick answers
- Is CVE-2026-94571 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-94571 being exploited in the wild.
- How severe is CVE-2026-94571?
- Informational severity, published 21 September 2026.
- Which products and versions are affected?
- OpenStack Octavia before 18.0.1.
- Is there a fix for CVE-2026-94571?
- A patch was published on 2026-09-17: Fixed in octavia 18.0.0-4 (Debian) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-94571 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-94571?
- Check whether you run OpenStack Octavia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Amphora provider driver in Octavia fails to sanitize control characters (including newlines) in the L7 policy redirect_url field before writing it into HAProxy configuration files. Although the RFC 3986 URL validator percent-encodes control characters before structural validation, the raw unencoded value is stored and interpolated directly into Jinja2 templates, allowing an authenticated project owner to break out of the URL context and inject arbitrary HAProxy directives. An attacker can override HTTP response codes, inject headers, or add new configuration blocks.
Affected products
- OpenStack Octavia before 18.0.1
Timeline
- 2026-09-21: disclosed
- 2026-09-17: patched: Fixed in octavia 18.0.0-4 (Debian)