The vulnerability in Red Hat OpenShift Container Platform 4 involves inadequate checks on the spec.path field within Route resource definitions. This allows an attacker with low privileges to inject arbitrary HAProxy configuration directives, effectively enabling external control over system or configuration settings. The issue impacts the routing mechanism that makes pods reachable via subdomains, potentially allowing high-impact attacks affecting confidentiality, integrity, and availability. The CVSS 3.1 score of 8.8 reflects the high severity of this vulnerability. As of the latest vendor advisory, no official patch or remediation level has been published.

Successful exploitation could allow an attacker with limited privileges to inject malicious HAProxy configuration, leading to full compromise of the routing layer in OpenShift. This can result in unauthorized access, data exposure, or disruption of service. The CVSS vector indicates low attack complexity and privileges required, no user interaction, and a scope change, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-1784 for current remediation guidance. Until an official fix is released, restrict access to Route resource creation and modification to trusted administrators only to reduce risk of exploitation.