CVE-2026-94571 Overview
CVE-2026-94571 is a code injection vulnerability [CWE-94] in OpenStack Octavia versions before 18.0.1. The Amphora provider driver fails to reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validation, allowing newline characters to pass structural checks. Octavia then writes the raw unencoded value directly into the HAProxy configuration on the amphora instance. An authenticated project member who owns a load balancer can inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider driver are affected.
Critical Impact
Authenticated tenants can inject arbitrary HAProxy directives into amphora configurations, enabling traffic redirection, credential harvesting, and potential compromise of the load balancer instance.
Affected Products
- OpenStack Octavia versions prior to 18.0.1
- Deployments using the Amphora provider driver
- OpenStack clouds exposing Octavia L7 policy APIs to project members
Discovery Timeline
- 2026-09-21 - CVE-2026-94571 published to NVD
- 2026-09-21 - OpenStack Security Advisory OSSA-2026-039 released
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-94571
Vulnerability Analysis
Octavia's Amphora provider generates HAProxy configuration files from user-supplied L7 policy attributes. The redirect_url and redirect_prefix fields accept URL values validated against RFC 3986. The validator percent-encodes control characters such as newlines (\n, \r) prior to structural checking, so encoded input passes validation. However, Octavia persists and renders the original unencoded string when generating the HAProxy configuration. Injected newline sequences terminate the current HAProxy directive and introduce attacker-controlled configuration lines. This effectively grants tenants control over HAProxy behavior on the amphora that fronts their load balancer.
Root Cause
The root cause is inconsistent input handling between validation and rendering. The RFC 3986 validator normalizes input for structural verification but does not enforce the normalized form on the stored value. The downstream configuration generator trusts the field content and writes it verbatim into HAProxy directives, producing a template injection primitive.
Attack Vector
Exploitation requires a project-level authenticated account with permission to create or modify a load balancer and its L7 policies. The attacker submits a REDIRECT_TO_URL L7 policy where redirect_url or redirect_prefix contains percent-encoded control characters followed by attacker-chosen HAProxy directives. After Octavia renders the configuration on the amphora, the injected directives take effect, allowing the attacker to alter routing, add ACLs, log sensitive request data, or otherwise manipulate HAProxy behavior within the amphora.
No verified public proof-of-concept code is available. Technical details are documented in OpenStack Security Advisory OSSA-2026-039 and the upstream fix in OpenStack commit bad7074621.
Detection Methods for CVE-2026-94571
Indicators of Compromise
- HAProxy configuration files on amphora instances containing unexpected directives outside the templated blocks generated by Octavia.
- L7 policy records in the Octavia database with redirect_url or redirect_prefix values containing %0a, %0d, or other percent-encoded control characters.
- Amphora HAProxy logs showing routing behavior that does not match the declared listener or pool configuration.
Detection Strategies
- Query the Octavia API for all L7 policies of type REDIRECT_TO_URL and inspect redirect_url and redirect_prefix for encoded control sequences.
- Compare rendered haproxy.cfg files on amphorae against the expected Jinja template output to detect injected directives.
- Audit Keystone and Octavia API logs for load balancer and L7 policy modifications by project members before patch deployment.
Monitoring Recommendations
- Enable verbose Octavia API logging and forward events to a centralized log platform for retrospective review.
- Monitor amphora instances for unexpected outbound connections, which may indicate injected directives are exfiltrating traffic.
- Alert on unauthorized changes to haproxy.cfg files on amphora VMs outside of the Octavia control plane workflow.
How to Mitigate CVE-2026-94571
Immediate Actions Required
- Upgrade OpenStack Octavia to version 18.0.1 or later on all controller and amphora images.
- Rebuild and redeploy amphora images so that new instances use the patched validation logic.
- Audit existing L7 policies for malicious redirect_url or redirect_prefix values and remediate affected load balancers.
Patch Information
The fix is applied in upstream commit bad7074621562d90a38be4639c1ab3e245f5bf39 and released in Octavia 18.0.1. Distribution updates are tracked in Debian Bug #1148175. Additional context is available in the Openwall OSS Security notice and Launchpad Bug #2162103.
Workarounds
- Restrict L7 policy creation to trusted project members using Octavia policy files until the patch can be applied.
- Deploy an API-layer filter that rejects redirect_url and redirect_prefix values containing percent-encoded control characters (%0a, %0d, %00).
- Where feasible, switch affected tenants to a non-Amphora provider driver that does not exhibit this behavior.
# Verify installed Octavia version and upgrade to 18.0.1 or later
pip show octavia | grep -i version
pip install --upgrade 'octavia>=18.0.1'
# Restart Octavia services after upgrade
systemctl restart octavia-api octavia-worker octavia-health-manager octavia-housekeeping
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.