EUVD-2026-33883
GHSA-qmrp-jx57-5mr7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
AnalysisAI
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Technical ContextAI
OpenShift's Route resource is a Kubernetes CRD that exposes services through the cluster's shared HAProxy-based ingress router. The router operator translates spec.path and related stanzas from Route YAML documents into an HAProxy backend/frontend configuration that is reloaded into the running HAProxy process. The flaw is rooted in CWE-15 (External Control of System or Configuration Setting): input validation on spec.path was insufficient, so attacker-controlled content can escape the intended path-matching context and be interpreted as additional HAProxy configuration directives. Affected CPE strings cover Red Hat OpenShift Container Platform 4 (cpe:2.3:a:red_hat:red_hat_openshift_container_platform_4:*).
RemediationAI
Patch available per vendor advisory - apply the Red Hat OpenShift Container Platform 4 errata for your z-stream as listed at https://access.redhat.com/security/cve/CVE-2026-1784 and tracked in https://bugzilla.redhat.com/show_bug.cgi?id=2436075 (exact fixed versions not enumerated in the supplied data, so cross-reference the RHSA aligned with your installed OCP minor). Until patched, restrict who can create or modify Route resources using RBAC - remove routes/create and routes/update from non-admin roles in shared namespaces, and consider an admission policy (OPA/Gatekeeper, Kyverno, or a ValidatingAdmissionPolicy) that rejects Route documents whose spec.path contains characters outside an allowlist such as [A-Za-z0-9/_.~-]; trade-off is that legitimate routes using exotic but valid path characters will be blocked and must be exempted. For multi-tenant clusters, audit existing Route objects across all namespaces for suspicious spec.path values before applying the fix.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Privilege escalation in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform allows a com
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated
Identity header smuggling in OpenShift Container Platform 4.x allows authenticated low-privilege users to escalate privi
Credential theft in Red Hat OpenShift Container Platform's Windows Machine Config Operator (WMCO) allows adjacent-networ
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon proces
Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memor
Here is the multi-source synthesis as a single JSON object: ```json { "product_name": "GnuTLS", "summary": "Certifi
Same technique Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today