CVE-2026-109575 in Data Plane API
Summary
by MITRE • 10/12/2026
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability in HAProxy Data Plane API versions 2.2.0 through 3.4.3 represents a critical authentication bypass rooted in flawed process-global state management within the Server.ConfigureAPI function. The core technical flaw arises from an improper interaction between TLS configuration parameters and the application's internal request handling logic. Specifically, when a user configures a TLS Certificate Authority via tls_ca and specifies a numeric TLS port via tls_port, the software executes a global flag that disables Basic authentication for its shared internal request handler. This design decision was likely intended to prevent credential exposure over unencrypted channels but fails to account for the multiplexed nature of the API's listener architecture. The vulnerability is classified under CWE-287 Improper Authentication because it results in the complete failure of identity verification mechanisms for specific access paths, allowing unauthorized entities to assume administrative privileges without valid credentials.
The operational impact is severe due to the shared context of the request handler across multiple transport types. HAProxy's Data Plane API utilizes a single internal server instance that concurrently serves HTTP, HTTPS, and UNIX domain socket listeners. While mutual TLS client certificate verification using tls.RequireAndVerifyClientCert is correctly enforced on the HTTPS path, this security control does not extend to the other active listeners. Because the authentication disablement flag was set globally rather than per-connection or per-listener, all non-mTLS endpoints inherit the disabled state. Consequently, an attacker who can reach either a standard HTTP management endpoint or a UNIX domain socket interface faces no authentication barrier. This allows unauthenticated remote actors over network connections and local attackers via Unix sockets to bypass security controls entirely. The vulnerability aligns with MITRE ATT&CK technique T1078 Valid Accounts in the context of privilege escalation, as it effectively grants full administrative access without requiring stolen credentials, exploiting a misconfiguration that renders existing authentication mechanisms inert for specific vectors.
The consequences of this flaw include unrestricted read and write access to the HAProxy configuration data. An unauthenticated attacker can exploit the raw configuration endpoint to exfiltrate sensitive information contained within the cleartext configuration files, which may include backend server addresses, SSL certificates, or other infrastructure details. More critically, the attacker can replace the managed configuration entirely, potentially leading to service disruption, traffic interception, or further compromise of the underlying network environment. This level of access effectively compromises the integrity and availability of the load balancing infrastructure controlled by HAProxy. The issue has been remediated in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, and 2.9.29, along with their respective Enterprise Edition backports. The fix involves migrating from the flawed process-global authentication logic to a per-request TLS connection-state validation model. This architectural change ensures that security controls are evaluated based on the specific transport layer of each incoming request rather than applying a blanket disablement across all listeners when any single listener is configured for mutual TLS, thereby maintaining consistent authentication enforcement regardless of the access vector used by the client.