CVE-2026-109575
CriticalCVSS 9.8Summary
HAProxy Data Plane API versions 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) have process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS CA is configured and a numeric TLS port is specified, the application globally disables Basic authentication on its shared internal request handler, allowing unauthenticated attackers to reach affected HTTP or UNIX endpoints and completely bypass credentials to gain full API administrative access.
Risk Assessment
An attacker can gain full administrative access to the API, allowing them to read sensitive HAProxy configuration data or replace the managed configuration entirely, potentially compromising the entire infrastructure.
Recommendation
Upgrade HAProxy Data Plane API to versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, or respective EE backports. Additionally, restrict access to management endpoints and enforce network-level authentication.
Related vulnerabilities
- CVE-2026-82110Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.
- CVE-2026-82103Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to an unauthorized actor. A remote authenticated attacker can exploit this to obtain confidential data.
- CVE-2026-82101Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that can lead to denial of service. A remote authenticated attacker can exploit this to disrupt service availability.
- CVE-2026-90920Critical
IBM Maximo AI Service 9.1.0 and 9.2.0 contains a vulnerability related to improper control of code generation. A remote attacker can exploit this to execute arbitrary code.
- CVE-2026-44828Critical
Qexo versions 4.0.0 through 4.2.0 expose /api/init_step/ without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token can reset the INIT setting and re-enter the setup flow, potentially exposing stored PROVIDER configuration including credentials.
- CVE-2026-109566Critical
Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.
- CVE-2026-108929Critical
Netcore NR268 version 1.7.121109 contains an argument injection vulnerability in the execvp function of the file /router/DDNSset.cgi in the DDNS component. Manipulating the Hostname argument can lead to argument injection, and the attack can be launched remotely.
- CVE-2025-71429Critical
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
- CVE-2026-96012Critical
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code and gain elevated privileges.
- CVE-2026-108362Critical
In Privasys Remote Attestation TLS Clients prior to 0.11.0, TEE attestation evidence is accepted without requiring an explicitly authorized platform identity. A network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, causing the verifier to accept valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. This allows impersonation of the attested TLS endpoint.
Original NVD description (English source)
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS