CVE-2026-1784: Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection

Synopsis

This is a configuration injection vulnerability in the HAProxy component of Red Hat OpenShift Container Platform 4, specifically triggered through the spec.path field of an OpenShift Route resource. An attacker with a low-privilege account on the cluster can craft a malicious Route document that injects arbitrary directives into the HAProxy configuration, without any network-level exposure or victim interaction required. Successful exploitation gives the attacker full control over the affected container's filesystem, running processes, and network activity, effectively achieving remote code execution within the HAProxy context with cross-container scope. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; the vulnerability is exploited locally via the Kubernetes API, not over an inbound network connection.

• AuthenticationRequired

  Any low-privilege cluster account with permission to create or modify Route resources is sufficient to trigger the injection.

• Victim interactionNot required

  No user action or social engineering is needed; submitting the malicious Route document is the entire attack.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions or special memory layout are required to inject the HAProxy configuration.

Blast Radius

• Reads secrets and environment variables accessible to the HAProxy process, including TLS certificates and session data for all routed traffic.
• Modifies the running HAProxy configuration, allowing the attacker to redirect or intercept traffic for any subdomain handled by the ingress operator.
• Crashes or restarts the ingress operator process, dropping routing for all services exposed through OpenShift Routes in the affected cluster.
• Because the CVSS scope is Changed, the impact extends beyond the HAProxy container boundary to other pods and resources sharing the node.