OpenStack Octavia EUVD-2026-84116

Exploitation requires (1) a deployment using the Amphora provider driver - OVN and other Octavia providers are explicitly NOT affected; (2) Octavia version before 18.0.1; and (3) an authenticated OpenStack project member who owns a load balancer (PR:L). The attacker creates a REDIRECT_TO_URL L7 policy and places control characters (newlines) plus additional HAProxy directives into the redirect_url or redirect_prefix field; the RFC 3986 validator percent-encodes control chars before validation so the payload passes structural checks, but the raw value is written into the generated HAProxy config on the amphora. Limiting factors: valid tenant credentials and ownership of a load balancer are mandatory (no unauthenticated path), and non-Amphora-provider deployments are immune.

This is a genuine high-priority issue, not an inflated CVSS. The vendor CVSS 4.0 base score is 9.4 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H with subsequent-system SC:H/SI:H/SA:H), reflecting that an authenticated, network-adjacent, low-complexity attack lets a legitimate tenant break out of the Octavia control-plane abstraction and inject arbitrary directives into the HAProxy configuration written on the amphora load-balancer instance. CWE-94 (code injection) and the RCE/Code Injection tags are consistent with the mechanism: arbitrary HAProxy directives can plausibly reach command execution on the amphora (e.g. external-check or Lua directives), which is why the subsequent-system impact metrics are all High. The tempering signal is PR:L - this is NOT unauthenticated; the attacker must be an authenticated project member who owns a load balancer, which limits it to insiders or attackers with valid tenant credentials. EPSS is not provided, there is NO CISA KEV listing, and no public exploit code is referenced, so despite the high score there is no evidence of active or automated exploitation yet - treat this as a serious latent risk requiring prompt patching rather than an emergency in-the-wild event. One caveat: the input provides only a CVSS 4.0 vector (no 3.1), so cross-framework severity comparison relies on the 4.0 vector alone.

An authenticated OpenStack tenant who owns a load balancer creates a REDIRECT_TO_URL L7 policy whose redirect_url or redirect_prefix field contains embedded newlines and additional HAProxy directives. Because the RFC 3986 validator percent-encodes control characters before checking structure, the malicious newline passes validation, but Octavia writes the raw unencoded value into the HAProxy config generated on the amphora, causing the injected directives to be executed by the load balancer. No public exploit code is identified at time of analysis, though the disclosure (OSSA-2026-039 and oss-security post) describes the mechanism in detail.