CVE-2026-94572

CriticalCVSS 9.4/10Last modified Sep 24, 2026

Description

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Metrics

CVSS 4.0 9.4/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 21, 2026
Last modified
Sep 24, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-945737.2The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all veCVE-2026-945747.8A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configurationCVE-2026-945755.7A logic vulnerability in Brocade Fabric OS versions before 10.0.1 web management framework allows an authenticated, low-privileged user to bCVE-2026-945768.0An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions befoCVE-2026-945777.8A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handling mechanism of Brocade Fabric CVE-2026-945788.8Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and AccountCVE-2026-945798.0An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session terminCVE-2026-94589.8A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWanCfg of the file /cgi-bin/CVE-2026-945804.5An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on BrocadCVE-2026-945816.8An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 thrCVE-2026-945827.8A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path FirsCVE-2026-945832.6A race condition vulnerability exists in the request processing logic of the REST management interface on Brocade Fabric OS versions before
CVE-2026-94572: Critical severity, CVSS 9.4 | Vulnix