Summary
It was discovered that Octavia did not properly validate TLS cipher
string fields in the Amphora provider driver. An authenticated
attacker who owns a TLS-enabled load balancer could possibly use
this issue to inject arbitrary HAProxy configuration directives.
(CVE-2026-94572)
It was discovered that Octavia did not properly validate L7 policy
redirect URL fields in the Amphora provider driver. An authenticated
attacker who owns a load balancer could possibly use this issue to
inject arbitrary HAProxy configuration directives. (CVE-2026-94571)
It was discovered that Octavia incorrectly handled quality of service
policy authorization. An authenticated attacker could possibly use
this issue to prevent deletion of another project's QoS policy.
(CVE-2026-74248)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | octavia | 1:10.1.1-0ubuntu1.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | octavia | 1:14.0.0-0ubuntu1.6 |
| Ubuntu · 26.04 LTS 26.04:LTS | octavia | 1:18.0.0-0ubuntu2.1 |
Vulnerabilities 3
-
Critical 9.4
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redi…
-
Critical 9.4
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers fiel…
-
Medium 4.3
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another proje…