Is CVE-2026-94572 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-94572 being exploited in the wild.

How severe is CVE-2026-94572?

Informational severity, published 21 September 2026.

Which products and versions are affected?

OpenStack Octavia before 18.0.1.

Is there a fix for CVE-2026-94572?

A patch was published on 2026-09-17: Fix released upstream; Debian fix in octavia 18.0.0-4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-94572 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-94572?

Check whether you run OpenStack Octavia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-94572: OpenStack Octavia HAProxy configuration injection in tls_ciphers field

CVE-2026-94572 · Severity: info · Published 2026-09-21

OpenStack Octavia is a load-balancing service that uses HAProxy on Amphora instances to distribute traffic. An authenticated project member can inject arbitrary HAProxy configuration directives by embedding newline characters in the TLS cipher list, potentially achieving remote code execution on the load balancer backend. Only deployments using the Amphora provider are affected.

Technologies: OpenStack Octavia. Vendors: OpenStack.

Quick answers

Is CVE-2026-94572 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-94572 being exploited in the wild.
How severe is CVE-2026-94572?: Informational severity, published 21 September 2026.
Which products and versions are affected?: OpenStack Octavia before 18.0.1.
Is there a fix for CVE-2026-94572?: A patch was published on 2026-09-17: Fix released upstream; Debian fix in octavia 18.0.0-4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-94572 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-94572?: Check whether you run OpenStack Octavia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Amphora provider driver fails to validate control characters (including newlines) in the tls_ciphers field of pools and listeners before writing the value verbatim into HAProxy configuration files via Jinja templates. An authenticated project member with permission to modify a TLS-enabled pool can inject arbitrary HAProxy directives on the server line, such as "check" or "alpn" options, or complete configuration statements. The vulnerability requires project membership and network access to the Octavia API; fixes are available in versions 18.0.1 and later.

Affected products

OpenStack Octavia before 18.0.1

Timeline

2026-07-30: disclosed: Bug reported on Launchpad
2026-09-21: advisory: OSSA-2026-039 security advisory published
2026-09-17: patched: Fix released upstream; Debian fix in octavia 18.0.0-4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.