CVE catalog

CVE-2026-94571

Severity: Critical · CVSS 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 14, 2026, 9:17:58 PM UTC
Updated: Sep 21, 2026, 9:17:21 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.53% · Oct 25, 2026

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	octavia	sid	`19.0.0-10`	fixed
Debian	octavia	forky	`19.0.0-10`	fixed
Debian	octavia	trixie	`16.0.0-2`	vulnerable
Debian	octavia	bookworm	`11.0.0-2`	vulnerable
Ubuntu	octavia	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	amphora-agent	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-api	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-common	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-doc	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-driver-agent	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-health-manager	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-housekeeping	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-worker	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	python3-octavia	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia	20.04	`5.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b1~git2019121614.45cb1e4e-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b2~git2020020614.005cd1e6-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b2~git2020020614.005cd1e6-0ubuntu2`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b3~git2020032609.73fca169-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b3~git2020041014.771a5d87-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0-0ubuntu0.20.04.2`	vulnerable
Ubuntu	octavia	20.04	`6.1.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.1-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.1-0ubuntu2`	vulnerable
Ubuntu	octavia	20.04	`6.2.2-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.2-0ubuntu1.1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.0+git2021120816.ab3c3ef7-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.1+git2022011217.27e5b27d-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.1+git2022030314.328ffbab-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.2`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.3`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.4`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.5`	fixed
Ubuntu	octavia	24.04	`1:13.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:13.0.0+git2024011917.5750e451-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.2`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.3`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.4`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.5`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia	26.04	`1:17.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:17.0.0+git20260116.e805a93-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu2`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	octavia	source	sid	`18.0.0-4`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	forky	`18.0.0-4`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1148175]
Ubuntu	octavia	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	amphora-agent	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-api	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-common	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-doc	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-driver-agent	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-health-manager	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-housekeeping	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-worker	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	python3-octavia	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia	deb	22.04	`1:10.1.1-0ubuntu1.5`	Not reported	UBUNTU-CVE-2026-94571	Not reported
Ubuntu	octavia	deb	24.04	`1:14.0.0-0ubuntu1.6`	Not reported	UBUNTU-CVE-2026-94571	Not reported
Ubuntu	octavia	deb	26.04	`1:18.0.0-0ubuntu2.1`	Not reported	UBUNTU-CVE-2026-94571	Not reported

[Debian bug #1148175]

Notes

[trixie] octavia: Minor issue [bookworm] octavia: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[octavia-agent]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-api]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-common]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-doc]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-driver-agent]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-health-manager]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-housekeeping]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-worker]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[python3-octavia]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12

[Debian 13 (Trixie)]

[octavia-agent]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-api]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-common]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-doc]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-driver-agent]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-health-manager]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-housekeeping]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-worker]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[python3-octavia]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13

Observed: Oct 23, 2026, 9:41:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]