EUVD-2026-97816
GHSA-7jqw-rhp8-c8vf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed HTTP or UNIX management endpoint
-
ExploitSend API request with no credentials
-
ExecutionBypass globally-disabled Basic authentication
-
ImpactRead or replace HAProxy configuration via raw endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the Data Plane API to be configured with a TLS Certificate Authority (tls_ca) AND a numeric TLS port (tls_port) - this specific combination is what globally disables Basic authentication on the shared request handler. Exploitation then requires that a non-mTLS listener (a plain HTTP server or a UNIX domain socket) is simultaneously active and reachable by the attacker, since mTLS client-certificate verification is enforced only on the HTTPS path. Limiting factors: this is a non-default mTLS deployment topology (default single-transport or auth-only setups are not affected), no authentication or user interaction is needed once a vulnerable listener is reachable, the HTTP listener is network-reachable (AV:N) while the UNIX-socket path is local-only (AV:L), and only versions 2.2.0 through 3.4.3 (and EE backports) prior to the fixed releases are affected. |
| Impact | All exploitability signals point to high severity: the input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scores 9.8 Critical, CWE-306 (Missing Authentication) matches the described fail-open behavior, and the impact is total (read sensitive cleartext config and fully replace it via the raw configuration endpoint - effectively administrative control over the load balancer). However, the signals are not uniformly alarming. No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no weaponized public exploit was supplied - the only exploitation artifact is the vendor's own fix commit, which includes a regression test demonstrating the bypass (this is proof the flaw is real and trivially reproducible, but is remediation code, not an attacker tool). One genuine tension: the CVSS vector is AV:N (network), yet the description's bypass paths are a plain HTTP listener (network-reachable) AND a UNIX domain socket (local-only) - AV:N correctly reflects the worst-case HTTP path, but a deployment exposing only the UNIX socket is realistically a local-access (AV:L) risk, so defenders should map exploitability to which listener is actually exposed. Critically, exploitability is gated on a specific non-default configuration (tls_ca + numeric tls_port with a concurrent non-mTLS listener), so this is a real priority for sites running the Data Plane API in exactly that mTLS topology, but is not a blanket 'every install is owned' situation. |
| Exploit ScenarioDerived | An operator runs the HAProxy Data Plane API with mTLS enabled (a configured tls_ca and numeric tls_port) while a plain HTTP or UNIX-socket management listener remains active. Because configuring mTLS globally disabled Basic auth on the shared handler and client-certificate verification is enforced only on the HTTPS path, an attacker who can reach the non-mTLS listener sends requests with no credentials and is served as a full administrator, then dumps or overwrites the HAProxy configuration via the raw endpoint. No public exploit exists, but the vendor fix commit ships a regression test that reproduces the credential-free bypass. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Unauthenticated remote attackers can gain full administrative control of the HAProxy Data Plane API - and through it the managed HAProxy load balancer - in Community and Enterprise Edition releases 2.2.0 through 3.4.3 when a specific mTLS topology is deployed. When a TLS Certificate Authority (tls_ca) and a numeric TLS port (tls_port) are configured, Server.ConfigureAPI() sets a process-global flag that disables HTTP Basic authentication on a request handler shared concurrently by HTTP, HTTPS, and UNIX-domain-socket listeners, while mutual-TLS client-certificate verification is only enforced on the HTTPS path; every other active listener therefore fails open. An attacker who can reach a plain HTTP or UNIX management endpoint can read cleartext HAProxy configuration data and replace the managed configuration via the raw configuration endpoint; no public exploit code has been identified at time of analysis, and the vendor has released fixed versions 3.4.4, 3.3.9, 3.2.17, 3.0.25 and 2.9.29 (plus EE backports).
RemediationAI
Upgrade to a vendor-released patched version - 3.4.4, 3.3.9, 3.2.17, 3.0.25 or 2.9.29 for Community Edition, or the matching Enterprise Edition backport - which replaces the global Basic-auth skip flag with per-request TLS connection-state validation (commit c3ae4e3ccff5490d44650565e445c4b15e8aff8c, tag v3.4.4). If upgrading is not immediately possible, break the vulnerable topology rather than relying on generic hardening: either remove the tls_ca configuration (Basic auth is then no longer globally disabled, at the cost of losing mTLS-based client authentication) or remove the numeric tls_port so the mTLS branch is not entered; alternatively, keep the mTLS deployment but ensure no non-mTLS listener is active - stop the plain HTTP listener, or bind it strictly to 127.0.0.1 so it is not network-reachable, since the bypass on the HTTP path is remotely exploitable with no authentication. Harden the UNIX domain socket path as a compensating control (it is reachable only locally): restrict the socket's filesystem permissions to the API service account and place it in a dedicated directory not writable by unprivileged users, accepting that any local user in that group retains full API administrative access. Restrict network access to the management API port with firewall or ACL rules and monitor Data Plane API access logs for unauthenticated requests to /v3/services/haproxy/configuration/raw, which is the endpoint an attacker would use to read or overwrite the managed configuration. Vendor documentation is at https://www.haproxy.com/documentation/haproxy-data-plane-api/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-306 (Missing Authentication for Critical Function), realized as a Go-specific design defect in the Data Plane API's HTTP middleware. The original BasicAuthMiddleware(skip bool) adapter took a boolean computed once from process configuration; when mTLS with a configured CA was detected (tls_ca set together with a numeric tls_port), skip was true and the middleware returned the next handler unconditionally for every request. Because a single http.Handler is registered on the plain HTTP listener, the mTLS HTTPS listener, and the UNIX domain socket listener, that boolean leaked across transports: TLS client-certificate verification (tls.RequireAndVerifyClientCert) is enforced only by the HTTPS server's tls.Config, so requests arriving over HTTP or the UNIX socket carried no verified identity yet still bypassed Basic auth. The fix (commit c3ae4e3ccff5490d44650565e445c4b15e8aff8c, released in v3.4.4) removes the global skip argument and migrates to a per-request TLS connection-state check - the middleware now allows the request through only when r.TLS != nil and r.TLS.VerifiedChains is non-empty, so HTTP and UNIX-socket requests, which never populate r.TLS, always require credentials. The new regression tests explicitly model a shared handler across a plain HTTP listener and an mTLS HTTPS listener, confirming that only verified-certificate requests skip Basic auth. Affected CPEs are cpe:2.3:a:haproxy:data_plane_api_ce and cpe:2.3:a:haproxy:data_plane_api_ee.
Know when Haproxy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated (PR:N, the bug is a total auth bypass) network-reachable HTTP listener (AV:N) with no interaction yields full read/replace of config, so C:H/I:H and A:H from config takeover.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.
Executive ViewAI
A critical authentication flaw in the HAProxy Data Plane API - the interface used to programmatically manage HAProxy load balancers - allows an attacker who can reach a plain HTTP or UNIX-domain-socket management endpoint to read the load balancer's configuration in cleartext and replace it with arbitrary configuration, effectively granting full administrative control over a component that fronts production traffic. Exposure is limited to organizations running Community or Enterprise Edition releases 2.2.0 through 3.4.3 in an mTLS topology where both a TLS certificate authority (tls_ca) and a numeric TLS port (tls_port) are configured, a hardening pattern common in regulated environments. No public exploit code has been identified at time of analysis, but the operational consequence of a compromised load balancer - traffic redirection, interception, or customer-facing outage - makes this a priority remediation item, and the vendor has released fixed versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
HAproxy 1.6.x before 1.6.6, when a deny comes from a reqdeny rule, allows remote attackers to cause a denial of service
An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request
A flaw was found in HAProxy before 2.0.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin throu
HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_
HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2
The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, re
The HTTP/2 implementation in HAProxy before 2.0.10 mishandles headers, as demonstrated by carriage return (CR, ASCII 0xd
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situatio
FastCGI framing desynchronization in HAProxy through 3.4.0 stems from a 16-bit integer overflow in the fcgi_conn demux r
Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 a
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can w
Exploit-DB