A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. (CVE-2026-108334)

CVE-2026-108334 describes a security flaw in the Kuadrant operator's internal WASM shim. Specifically, the shim does not correctly escape values derived from HTTPRoute match fields when generating the CEL predicate responsible for enforcing Gateway-level authentication and rate limiting. An attacker able to create or modify HTTPRoute resources on a shared Gateway can supply crafted path, header, or query match values that cause the predicate to bypass these security checks. This results in requests bypassing authentication and rate limiting controls while still being forwarded to the backend service. The vulnerability has a CVSS v3.1 score of 7.4 (high severity) with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and impacts on confidentiality, integrity, and availability. Red Hat has issued a security update for Red Hat Connectivity Link 1.4 addressing this issue, with updated container images available in the Red Hat container registry.

The flaw allows an attacker with permission to create or modify HTTPRoute resources on a shared Gateway to bypass Gateway-level authentication and rate limiting checks. This could lead to unauthorized access and potential abuse of backend services. The request is still forwarded to the backend, so the attacker can interact with backend services without the intended security controls being enforced. The CVSS score of 7.4 indicates a high severity impact affecting confidentiality, integrity, and availability.

A security update addressing this vulnerability is available from Red Hat as part of Red Hat Connectivity Link 1.4. Updated container images including rhcl-1/wasm-shim-rhel9 and related components have been published in the Red Hat container registry. Users should apply these updates by pulling the fixed container images as per the Red Hat advisory (RHSA-2026:83531) to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.