CVE catalog

CVE-2026-94572

Severity: Critical · CVSS 9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Aug 14, 2026, 9:17:58 PM UTC
Updated: Sep 21, 2026, 9:17:22 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.53% · Oct 25, 2026

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	octavia	sid	`19.0.0-10`	fixed
Debian	octavia	forky	`19.0.0-10`	fixed
Debian	octavia	trixie	`16.0.0-2`	vulnerable
Debian	octavia	bookworm	`11.0.0-2`	vulnerable
Ubuntu	octavia	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	amphora-agent	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-api	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-common	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-doc	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-driver-agent	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-health-manager	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-housekeeping	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia-worker	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	python3-octavia	noble	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia	20.04	`5.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b1~git2019121614.45cb1e4e-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b2~git2020020614.005cd1e6-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b2~git2020020614.005cd1e6-0ubuntu2`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b3~git2020032609.73fca169-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0~b3~git2020041014.771a5d87-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0-0ubuntu0.20.04.1`	vulnerable
Ubuntu	octavia	20.04	`6.0.0-0ubuntu0.20.04.2`	vulnerable
Ubuntu	octavia	20.04	`6.1.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.0-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.1-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.1-0ubuntu2`	vulnerable
Ubuntu	octavia	20.04	`6.2.2-0ubuntu1`	vulnerable
Ubuntu	octavia	20.04	`6.2.2-0ubuntu1.1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.0+git2021120816.ab3c3ef7-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.1+git2022011217.27e5b27d-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:9.0.1+git2022030314.328ffbab-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.0-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.1`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.2`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.3`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.4`	vulnerable
Ubuntu	octavia	22.04	`1:10.1.1-0ubuntu1.5`	fixed
Ubuntu	octavia	24.04	`1:13.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:13.0.0+git2024011917.5750e451-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0~rc1-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.1`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.2`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.3`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.4`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.5`	vulnerable
Ubuntu	octavia	24.04	`1:14.0.0-0ubuntu1.6`	fixed
Ubuntu	octavia	26.04	`1:17.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:17.0.0+git20260116.e805a93-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0~rc1-0ubuntu2`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu1`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu2`	vulnerable
Ubuntu	octavia	26.04	`1:18.0.0-0ubuntu2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	octavia	source	sid	`18.0.0-4`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	forky	`18.0.0-4`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1148175]
Debian	octavia	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1148175]
Ubuntu	octavia	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	amphora-agent	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-api	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-common	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-doc	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-driver-agent	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-health-manager	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-housekeeping	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia-worker	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	python3-octavia	deb	noble	`1:14.0.0-0ubuntu1.6`	Not reported	Not reported	Not reported
Ubuntu	octavia	deb	22.04	`1:10.1.1-0ubuntu1.5`	Not reported	UBUNTU-CVE-2026-94572	Not reported
Ubuntu	octavia	deb	24.04	`1:14.0.0-0ubuntu1.6`	Not reported	UBUNTU-CVE-2026-94572	Not reported
Ubuntu	octavia	deb	26.04	`1:18.0.0-0ubuntu2.1`	Not reported	UBUNTU-CVE-2026-94572	Not reported

[Debian bug #1148175]

Notes

[trixie] octavia: Minor issue [bookworm] octavia: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[octavia-agent]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-api]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-common]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-doc]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-driver-agent]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-health-manager]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-housekeeping]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[octavia-worker]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
[python3-octavia]Affected
Source package: [octavia]
Details (2)
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12
- 11.0.0-2 · all · bookworm
  Affected
  nvd · octavia · debian · bookworm; nvd · octavia · debian · 12

[Debian 13 (Trixie)]

[octavia-agent]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-api]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-common]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-doc]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-driver-agent]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-health-manager]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-housekeeping]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[octavia-worker]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
[python3-octavia]Affected
Source package: [octavia]
Details (2)
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13
- 16.0.0-2 · all · trixie
  Affected
  nvd · octavia · debian · 13

Observed: Oct 23, 2026, 9:41:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]