CVE-2026-109575

9.8 CRITICALpublic exploit available

Published 2026-10-12 · Updated 2026-10-16

AI risk analysis

Summary: HAProxy Data Plane API suffers from a critical authentication bypass vulnerability where process-global authentication logic fails to properly secure multiple transport types, allowing unauthenticated access to administrative APIs when TLS is configured with numeric ports. This affects HTTP and UNIX domain socket listeners that should require authentication but fail open due to shared internal request handlers.
Exploitability: Exploitation is straightforward for attackers who can reach HTTP or UNIX management endpoints, requiring only basic network connectivity and no special credentials or preconditions beyond the vulnerable configuration.
Blast radius: The vulnerability could allow unauthorized remote or local actors to gain full administrative access to HAProxy configurations, enabling them to read sensitive cleartext configuration data or replace managed configurations entirely across affected deployments.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, or their respective Enterprise Edition backports immediately.

auth-bypasshaproxyconfigapi

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.