CVE-2026-94572: Openstack Octavia

Critical severity, CVSS 9.4. EPSS: 0.5% chance of exploitation in the next 30 days.

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Affected products

• Openstack Octavia: from 6.0.0, before 16.1.0 (fixed in 16.1.0); from 17.0.0, before 17.0.1 (fixed in 17.0.1); from 18.0.0, before 18.0.1 (fixed in 18.0.1)

Published 2026-09-21. Last modified 2026-09-24.