The vulnerability CVE-2026-1784 affects the Route resource in Red Hat OpenShift Container Platform 4.19 and 4.21. The Route resource allows defining routes to expose pods via HAProxy. Insufficient validation of the spec.path YAML stanza in a Route document permits controlled injection of HAProxy configuration, leading to external control of system or configuration settings (CWE-15). The CVSS v3.1 score is 8.8 (high severity) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating local attack vector with low complexity, requiring low privileges, no user interaction, and resulting in high impact on confidentiality, integrity, and availability. Red Hat has issued security advisories RHSA-2026:23241 and RHSA-2026:23246 providing fixed container images and packages in OpenShift Container Platform 4.21.19 and 4.19.33 respectively. Users should upgrade their clusters following Red Hat's upgrade instructions to fully apply the fixes.

Successful exploitation of this vulnerability allows an attacker with low privileges and local access to inject malicious HAProxy configuration via the Route resource's spec.path YAML stanza. This can lead to complete compromise of confidentiality, integrity, and availability of the affected OpenShift cluster components. The vulnerability affects on-premise or private cloud deployments of Red Hat OpenShift Container Platform versions prior to 4.19.33 and 4.21.19. No known exploits in the wild have been reported at this time.

Red Hat has released fixed container images and packages in OpenShift Container Platform versions 4.19.33 and 4.21.19 that address CVE-2026-1784. Users should upgrade their OpenShift clusters to these versions as soon as possible following the official Red Hat upgrade documentation. The vendor manages remediation for these on-premise/private cloud deployments, and no additional mitigation steps are indicated beyond applying the official updates.