CVE-2026-1784 affects Red Hat OpenShift Container Platform by allowing insufficient validation of the spec.path YAML stanza in Route resources. This flaw permits an attacker with low privileges to inject HAProxy configuration, potentially leading to remote code execution. The vulnerability is tracked under multiple CWEs including CWE-15 (External Control of System or Configuration Setting). Red Hat has issued a security advisory and released updated container images and RPM packages, notably OpenShift Container Platform 4.13.68, to fix this issue. The vulnerability has a Red Hat CVSS v3.1 score of 8.8 (high severity) with local attack vector, low complexity, and no user interaction required. The vendor advisory provides detailed upgrade instructions and recommends applying the updates promptly.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary code remotely by injecting malicious HAProxy configuration via the Route resource's spec.path field. This impacts confidentiality, integrity, and availability of the affected OpenShift Container Platform deployments. However, no known exploits in the wild have been reported to date.

Red Hat has released fixed container images and RPM packages for OpenShift Container Platform, including version 4.13.68 and later. Users should upgrade their clusters to these updated versions following Red Hat's official upgrade documentation. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without patching. Therefore, applying the official updates is the recommended mitigation.