Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109575

Quick assessment

Affected
HAProxy Data Plane API EE
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 HAProxy Data Plane API 2.2.0 至 3.4.3 版本（以及对应的企业版 EE 发布版本）中，Server.ConfigureAPI() 函数包含了一种进程全局范围的认证逻辑，该逻辑错误地在多种传输类型之间放宽了安全控制措施。 当配置了 TLS 证书颁发机构（tls_ca）并指定了 TLS 端口（tls_port）时，应用程序会在其共享的内部请求处理程序上全局禁用 Basic 认证。由于该请求处理程序被 HTTP、HTTPS 以及 UNIX 域套接字监听器并发共享使用，而双向 TLS（m

CVSS 9.8 · Critical EPSS 0.36% · P28

Affected Version Matrix 10

VendorProduct Version RangeStatus
HAProxy Data Plane API CE 2.2.0≤ 2.9.28 affected
3.0.0≤ 3.0.24 affected
3.1.0≤ 3.2.16 affected
3.3.0≤ 3.3.8 affected
3.4.0≤ 3.4.3 affected
HAProxy Data Plane API EE 2.2.0-ee1≤ 2.9.28-ee1 affected
3.0-ee≤ 3.0.24-ee1 affected
3.1-ee≤ 3.2.16-ee1 affected
3.3-ee≤ 3.3.8-ee1 affected
3.4-ee≤ 3.4.3-ee2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109575

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
HAProxy Data Plane API EE 2.2.0-ee1 ~ 2.9.28-ee1 -
HAProxy Data Plane API CE 2.2.0 ~ 2.9.28 -

II. Public POCs for CVE-2026-109575

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109575

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-109575 (1)

Vendor Pages for CVE-2026-109575 (2)

IV. Related Vulnerabilities

Same vendor: HAProxy
Same weakness: CWE-306

V. Comments for CVE-2026-109575

No comments yet

Leave a comment