CVE-2026-109575: CWE-306 Missing Authentication for Critical Function in HAProxy Data Plane API EE

In HAProxy Data Plane API EE versions 2.2.0 through 3.4.3, the Server.ConfigureAPI() function implements process-global authentication logic that improperly disables Basic authentication on a shared internal request handler when a TLS Certificate Authority and numeric TLS port are configured. Mutual TLS client certificate verification is only enforced on the HTTPS server path, causing other listeners (HTTP and UNIX domain sockets) to fail open and allow unauthenticated access. This flaw permits attackers with network or local access to management endpoints to bypass authentication and gain full administrative API control, including reading or modifying HAProxy configurations. The issue is resolved in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective Enterprise Edition backports by switching to per-request TLS connection-state validation.

An unauthenticated attacker who can reach affected HTTP or UNIX domain socket management endpoints can bypass authentication controls and gain full administrative access to the HAProxy Data Plane API. This allows reading sensitive cleartext configuration data or completely replacing the managed configuration, potentially leading to full compromise of HAProxy management and control.

This vulnerability has been fixed in HAProxy Data Plane API EE versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective backports. Users should upgrade to these fixed versions to remediate the issue. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.