Homepage

Arbitrary Code Injection Affecting octavia package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.33% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-OCTAVIA-20044352
  • published22 Sept 2026
  • disclosed21 Sept 2026
Report a new vulnerability Found a mistake?

Introduced: 21 Sep 2026

NewCVE-2026-94571  (opens in a new tab)
CWE-94  (opens in a new tab)

How to fix?

There is no fixed version for Echo:latest octavia.

NVD Description

Note: Versions mentioned in the description apply only to the upstream octavia package and not the octavia package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes control characters before validating, and thus newlines passed structural checks, but Octavia stored and wrote the raw unencoded value directly into the HAProxy configuration generated on the amphora. An authenticated project member who owns a load balancer can therefore inject arbitrary HAProxy directives through a REDIRECT_TO_URL L7 policy. Only deployments using the Amphora provider are affected.