CVE-2026-108334: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') in Red Hat Red Hat Connectivity Link 1

This vulnerability arises from improper escaping of user-controlled input in the generation of a CEL predicate within the WebAssembly shim of the Kuadrant operator in Red Hat Connectivity Link 1. Specifically, crafted path, header, or query match values in an HTTPRoute attached to a shared Gateway can manipulate the predicate logic, bypassing Gateway-level authentication and rate limiting. The issue is an expression language injection that affects the enforcement of security controls at the Gateway layer.

An attacker who can create or modify HTTPRoute resources on a shared Gateway can bypass Gateway-level authentication and rate limiting, potentially allowing unauthorized or excessive access to backend services. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:L/I:L/A:L). However, the request is still forwarded to the backend, so backend protections remain relevant.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-108334 for current remediation guidance. Until an official fix is available, restrict permissions to create or modify HTTPRoute resources on shared Gateways to trusted users only to reduce risk.