CVE-2026-94572Published
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus…
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-94572 · Microsoft / collected KEV context
cve-program · CVE-2026-94572
- https://bugs.launchpad.net/octavia/+bug/2162101
- https://bugs.launchpad.net/octavia/+bug/2167565
- https://bugs.debian.org/1148175
- https://opendev.org/openstack/octavia/commit/cad62902e4984a46ad80cbfa943e90006d8d599d
- https://security.openstack.org/ossa/OSSA-2026-039.html
- https://openwall.com/lists/oss-security/2026/09/21/6
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.