CVE-2026-109575: HAProxy Data Plane API Auth Bypass Vulnerability

CVE-2026-109575 Overview

CVE-2026-109575 is an authentication bypass vulnerability in HAProxy Data Plane API versions 2.2.0 through 3.4.3, including corresponding Enterprise Edition releases. The flaw resides in Server.ConfigureAPI(), where process-global authentication logic drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) and numeric TLS port (tls_port) are configured, the application globally disables Basic authentication on its shared internal request handler. Mutual TLS (mTLS) client certificate verification is enforced only on the HTTPS listener, so concurrently active HTTP and UNIX domain socket listeners fail open. An unauthenticated attacker reaching a non-mTLS management endpoint can bypass credentials and obtain full API administrative access. This maps to [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated remote or local attackers can read cleartext HAProxy configuration data or replace the managed configuration entirely through the raw configuration endpoint.

Affected Products

HAProxy Data Plane API 2.2.0 through 3.4.3
HAProxy Enterprise Edition backports of the affected 2.x and 3.x branches
Deployments configured with both tls_ca and a numeric tls_port while exposing non-mTLS HTTP or UNIX socket listeners

Discovery Timeline

2026-10-12 - CVE-2026-109575 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-109575

Vulnerability Analysis

The HAProxy Data Plane API exposes a single HTTP handler reused across HTTP, HTTPS, and UNIX socket listeners. The pre-patch configureAPI() function accepted a skipBasicAuth boolean that disabled Basic authentication globally when mTLS was configured. The authentication middleware honored this flag at construction time rather than evaluating each request's transport context.

Because tls.RequireAndVerifyClientCert only governs the HTTPS server path, requests arriving on plaintext HTTP or UNIX domain sockets inherit the globally disabled Basic auth state without ever presenting a client certificate. The handler accepts them as authenticated, granting the caller full administrative capabilities over the proxied HAProxy configuration.

Root Cause

The root cause is a conflation of transport-level security policy with application-level request authentication. A per-process boolean was used to represent what should be a per-request decision based on the actual TLS connection state. The middleware trusted its construction-time parameter instead of inspecting r.TLS and r.TLS.VerifiedChains on each incoming request.

Attack Vector

An attacker who can reach any non-mTLS Data Plane API endpoint, whether a plaintext HTTP listener on the network or a UNIX socket on the local host, can issue API calls without credentials. The attacker can retrieve the running HAProxy configuration in cleartext, including backend definitions and any embedded secrets, and overwrite the configuration through the raw configuration endpoint to redirect traffic or disable security controls.

// Patch excerpt from adapters/adapters.go
// BasicAuthMiddleware enforces HTTP Basic authentication on every request,
// except requests that arrived over TLS with a client certificate verified
// against the configured CA (mTLS). The HTTP and Unix listeners share this
// handler and never set r.TLS, so they always require credentials.
func BasicAuthMiddleware() Adapter {
    return func(h http.Handler) http.Handler {
        return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
            if r.TLS != nil && len(r.TLS.VerifiedChains) > 0 {
                h.ServeHTTP(w, r)
                return
            }
            user, pass, ok := r.BasicAuth()
            if !ok {
                writeUnauthorized(w, "missing or invalid authorization")

Source: HAProxy Data Plane API patch commit c3ae4e3

The companion change in configure_data_plane.go removes the skipBasicAuth parameter entirely, eliminating the global flag that caused the bypass:

// Before:
// func configureAPI(skipBasicAuth bool, maxBodySize int64) (http.Handler, func())
// After:
func configureAPI(maxBodySize int64) (http.Handler, func()) {
    clientMutex.Lock()
    defer clientMutex.Unlock()

Source: HAProxy Data Plane API patch commit c3ae4e3

Detection Methods for CVE-2026-109575

Indicators of Compromise

Successful HTTP 200 responses to Data Plane API endpoints such as /v2/services/haproxy/configuration/raw without an Authorization: Basic header
Unexpected GET or POST requests to /v2/, /v3/, or /services/haproxy/configuration/* from source addresses that are not part of the management plane
Configuration version increments or PUT operations on the raw configuration endpoint outside of change-management windows
UNIX socket activity on the Data Plane API socket originating from processes other than approved automation users

Detection Strategies

Audit Data Plane API access logs for requests missing the Basic authentication header that still returned non-401 status codes.
Correlate HAProxy reload events with the identity and transport of the API caller that triggered the configuration change.
Compare the running HAProxy configuration against the version-controlled source of truth to detect unauthorized modifications.

Monitoring Recommendations

Forward Data Plane API access logs and HAProxy reload events to a centralized SIEM for correlation with network and identity telemetry.
Alert on any inbound connection to the Data Plane API HTTP port from outside the designated management network segment.
Monitor file integrity on the HAProxy configuration directory and the UNIX socket path used by the Data Plane API.

How to Mitigate CVE-2026-109575

Immediate Actions Required

Upgrade to HAProxy Data Plane API 3.4.4, 3.3.9, 3.2.17, 3.0.25, or 2.9.29, or the matching Enterprise Edition backport.
Restrict network reachability of plaintext HTTP Data Plane API listeners to trusted management hosts only.
Rotate any credentials, API tokens, or TLS keys that may have been exposed through the configuration endpoint while the vulnerable version was reachable.

Patch Information

The fix migrates to a per-request TLS connection-state validation model. The patched BasicAuthMiddleware inspects r.TLS.VerifiedChains on every request and only skips Basic auth when a valid mTLS client certificate is presented. See the HAProxy Data Plane API v3.4.4 release and the v3.4 changelog.

Workarounds

Disable the HTTP listener and the UNIX socket listener, exposing only the HTTPS listener that enforces mTLS, until patching is possible.
Place a reverse proxy or firewall in front of the Data Plane API that requires client certificate authentication before forwarding requests.
Remove either tls_ca or tls_port from the configuration so the application does not trigger the global Basic auth bypass path.

bash

# Verify installed Data Plane API version and upgrade
dataplaneapi --version

# Example: restrict the API to a loopback interface and mTLS-only HTTPS
dataplaneapi \
  --host 127.0.0.1 \
  --scheme https \
  --tls-host 0.0.0.0 \
  --tls-port 5556 \
  --tls-certificate /etc/haproxy/certs/api.crt \
  --tls-key /etc/haproxy/certs/api.key \
  --tls-ca /etc/haproxy/certs/ca.crt