Description
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
Problem types
External Control of System or Configuration Setting
Product status
Timeline
| 2026-02-02: | Reported to Red Hat. |
| 2026-06-02: | Made public. |
References
access.redhat.com/security/cve/CVE-2026-1784
bugzilla.redhat.com/show_bug.cgi?id=2436075 (RHBZ#2436075)