Threat database

CVE-2026-109575 is a critical authentication bypass vulnerability in HAProxy Data Plane API Enterprise Edition versions 2.2.0 through 3.4.3. The flaw arises from a process-global authentication logic error that disables Basic authentication on shared internal request handlers when TLS CA and numeric TLS port are configured. This causes non-mutual TLS listeners such as HTTP and UNIX domain socket endpoints to fail open, allowing unauthenticated attackers to gain full administrative API access. Exploitation enables reading or replacing HAProxy configuration data without credentials. The issue is fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and corresponding Enterprise Edition backports.

Inefficient algorithm complexity in mjson in HAProxy allows remote attackers to cause a denial of service via specially crafted JSON requests.

HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permissions. This can result in obtaining an ingress token secret as a response. The fixed versions of HAProxy Enterprise Kubernetes Ingress Controller are 3.0.16-ee1, 1.11.13-ee1, and 1.9.15-ee1.