OpenStack Octavia Fixes HAProxy Configuration Injection
Tech GuruQuick Answer
OSSA-2026-039 covers HAProxy configuration injection in OpenStack Octavia's Amphora provider. An authenticated tenant who owns a load balancer can reach root execution on its amphora through affected fields, with potential exposure of other tenants' secrets and access toward the control plane. Other provider drivers are not affected.
Confirm Scope And Apply The Supported Fix
What to do now: Identify the Octavia branch and Amphora usage, then obtain the supported update containing both applicable fixes. Verify the actual distribution package or backport; do not assume a release number alone proves both changes are present.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | OpenStack Octavia deployments using the Amphora provider driver |
|---|---|
| Advisory | OSSA-2026-039 |
| CVEs | CVE-2026-94571, CVE-2026-94572 |
| Authoritative release date | 2026-09-21 (OSSA publication date) |
| Authority revision date | 2026-09-21 (Errata 1 in OSSA history). The documentation build timestamp is not the advisory revision date. |
| Affected versions | Octavia 0.8.0 through versions before 16.1.0, plus 17.0.0 and 18.0.0; only the Amphora provider is affected. |
| Fixed version | Use the two branch-specific changes linked by OSSA: 2025.1 Epoxy 1001096 and 1001097; 2025.2 Flamingo 1001094 and 1001095; 2026.1 Gazpacho 1001091 and 1001092; 2026.2 Hibiscus 999553 and 999555. The affected range ends before 16.1.0 and also lists 17.0.0 and 18.0.0. This advisory check does not establish availability of distribution builds numbered 17.0.1 or 18.0.1; obtain the branch-supported patched package. Before Octavia 6.0, only the L7 fix applies because tls_ciphers was not yet present. |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | OpenStack reports a proof of concept demonstrating the impact, but the checked OSSA does not report in-the-wild exploitation. These are distinct evidence categories. |
What Changed
A proof of concept showed that control characters in listener/pool tls_ciphers and L7 redirect URL/prefix fields could cross the tenant-to-provider boundary. OpenStack therefore reclassified the issue from low-impact hardening. The public demonstration is not, by itself, a report of exploitation in the wild.
What To Validate Now
- Inventory. Record Octavia release/backports, provider drivers, amphora inventory and owners of tenant-facing load-balancer APIs.
- Establish applicability. Compare each deployment with the authority's affected-version statement: Octavia 0.8.0 through versions before 16.1.0, plus 17.0.0 and 18.0.0; only the Amphora provider is affected. Do not infer applicability from product family or severity alone.
- Remediate. Use the supported branch update containing both relevant changes, not only the tls_ciphers or only the L7 validation patch. Confirm inclusion with the distribution or service maintainer.
- Validate. Record package/backport identifiers and both included fixes. In an isolated validation environment, confirm normal listener, pool and L7-policy changes still work and invalid control characters are rejected; check load-balancer health and tenant boundaries after rollout.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The attack requires an authenticated tenant with a load balancer, but the consequences can extend beyond that tenant. Review potential exposure of TLS keys/certificates, the amphora heartbeat key and reachable control-plane services if compromise is suspected. Coordinate recovery with incident response; patching alone does not resolve any secrets already exposed. Test dependencies and rollback before broad rollout.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
