CVE-2026-109575Published
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS…
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109575 · Microsoft / collected KEV context
cve-program · CVE-2026-109575
- https://www.haproxy.com/documentation/haproxy-data-plane-api/
- https://www.haproxy.com/documentation/haproxy-data-plane-api/community/changelog/#version-3.4
- https://github.com/haproxytech/dataplaneapi/commit/c3ae4e3ccff5490d44650565e445c4b15e8aff8c
- https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.4
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.