CVE-2026-94571 in Octavia
Summary
by MITRE • 09/21/2026
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in OpenStack Octavia prior to version 18.0.1 represents a critical configuration injection flaw within the Amphora load balancer driver, specifically affecting Layer Seven policies that utilize redirect actions. This security issue stems from an inadequate input validation mechanism when processing URL fields such as redirect_url and redirect_prefix. While the system employs an RFC 3986 compliant validator to ensure structural integrity of URLs, this validator performs percent-encoding on control characters before conducting its checks. Consequently, inputs containing newline characters or other control sequences pass the initial validation phase because they appear syntactically correct after encoding. However, a subsequent processing step fails to maintain this encoded state when writing configuration data. Instead of persisting the safely encoded representation, Octavia stores and writes the raw, unencoded value directly into the HAProxy configuration file generated for the Amphora instance. This discrepancy between validation logic and actual data persistence creates a significant security gap that allows malicious actors to bypass intended restrictions on input content.
The operational impact of this flaw is severe due to its potential for arbitrary command execution through configuration injection. An authenticated user who holds ownership or appropriate permissions over a specific load balancer resource can exploit this behavior by crafting L7 policy rules with redirect URLs containing embedded newline characters and subsequent HAProxy directives. By injecting these commands, the attacker effectively gains the ability to modify the underlying HAProxy configuration file on the Amphora virtual machine. Since HAProxy executes configurations based on its directive syntax, an injected command such as a new backend definition or access control rule can alter traffic routing, expose internal services, or facilitate further network pivoting within the OpenStack environment. This vulnerability is particularly dangerous because it leverages legitimate administrative interfaces and requires only standard user-level authentication rather than privileged admin credentials to execute, thereby expanding the attack surface significantly across multi-tenant deployments.
From a classification perspective, this vulnerability aligns with CWE-94, commonly known as Improper Control of Generation of Code or Commands (Code Injection), specifically manifesting through configuration file manipulation. The attacker utilizes valid input channels but injects malicious structural elements that are interpreted by the downstream application layer rather than being treated as data. Furthermore, in the context of the MITRE ATT&CK framework, this technique corresponds to T1505.003, Server Software Component: Web Shell or Configuration File Modification, where an adversary modifies server configuration files to maintain persistence or expand access. The specific mechanism here involves manipulating L7 policy parameters which are part of the application layer traffic management logic, making it a sophisticated form of injection that targets infrastructure-as-code generation processes rather than direct database queries or script execution.
Mitigation strategies must prioritize immediate patching and strict input sanitization for affected deployments. Organizations running OpenStack Octavia with the Amphora provider driver should upgrade to version 18.0.1 or later, where this validation logic has been corrected to ensure that control characters are either rejected outright or consistently encoded throughout the entire lifecycle of data processing from API entry to configuration file generation. For environments unable to patch immediately due to operational constraints, a temporary workaround involves implementing strict input filtering at the reverse proxy level preceding Octavia to strip out non-printable ASCII characters and newline sequences before they reach the OpenStack APIs. Additionally, security teams should audit existing L7 policies for any anomalies in redirect URLs that might indicate prior exploitation attempts. Regular monitoring of HAProxy configuration files on Amphora instances can also help detect unauthorized changes resulting from successful injection attacks, ensuring rapid incident response capabilities are in place to contain potential breaches stemming from this vulnerability.