CVE-2026-109575

Executive Summary

CVE-2026-109575 is a critical authentication bypass (CWE-306) in the HAProxy Data Plane API affecting versions 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases. A process-global flaw in Server.ConfigureAPI() causes Basic authentication to be disabled across all shared listeners whenever a TLS CA (tls_ca) and a numeric TLS port (tls_port) are configured, while mTLS client verification is enforced only on the HTTPS path. Because the internal request handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, all non-mTLS listeners fail open, allowing unauthenticated attackers to fully bypass credentials and gain administrative control of the API. The impact is total loss of confidentiality and integrity (CVSS 9.8), enabling exfiltration or wholesale replacement of managed HAProxy configuration.

Technical Analysis

The HAProxy Data Plane API is the management plane used to programmatically read and write HAProxy load balancer configuration. The vulnerability resides in the authentication logic implemented by Server.ConfigureAPI(), which is described as process-global rather than per-request or per-listener.

The described failure sequence is:

1. Configuration trigger: When a TLS Certificate Authority is configured (the tls_ca setting) and a numeric TLS port is specified (the tls_port setting), the application globally disables Basic authentication on its shared internal request handler.
2. Shared handler scope: That internal request handler is shared concurrently across multiple transport types — HTTP, HTTPS, and UNIX domain socket listeners. The security control is therefore applied (or removed) at process scope, not at listener scope.
3. Asymmetric enforcement: Mutual TLS client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path. Consequently, non-mTLS listeners (plain HTTP and UNIX domain sockets) do not inherit any client authentication requirement.
4. Fail-open result: Because Basic authentication was globally disabled and mTLS is not enforced on the non-TLS paths, all simultaneously active non-mTLS listeners fail open. Requests reaching those listeners are processed without any credential check.

The combined effect is that mutual authentication on the HTTPS listener provides an illusion of a secured deployment, while the HTTP and UNIX socket listeners on the same process accept unauthenticated administrative requests. The flaw class is a state-confusion / shared-handler authentication defect: a global authentication toggle is set based on the presence of specific TLS configuration options, without validating the TLS connection state on each individual request.

The upstream fix (versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and EE backports) migrates to a per-request TLS connection-state validation model, meaning authentication decisions are made per connection/request rather than through a process-global flag. This is the architecturally correct remediation because it eliminates cross-listener authentication state leakage.

No public proof-of-concept, Nuclei template, or exploit code is currently available. The analysis above is derived strictly from the NVD description; specific internal function bodies, route paths, or handler names beyond those quoted are not disclosed and are not speculated here.

Exploitation Scenarios

The attack chain below is inferred at the vulnerability-class level from the NVD description. No public PoC exists; none of the following steps relies on undisclosed implementation details.

1) Reconnaissance / target identification An attacker identifies a reachable HAProxy Data Plane API management endpoint. Because the flaw affects any non-mTLS listener on the same process, reachability of the plain HTTP management port or a UNIX domain socket (e.g., from a co-located container, local shell, or a container escape) is sufficient. Note that the HTTPS listener alone, if it enforces mTLS, is not the permissive path — the attacker seeks the HTTP or UNIX socket transport that shares the same backend handler.

2) Triggering the flaw The precondition is that the deployment has both a TLS CA (tls_ca) and a numeric TLS port (tls_port) configured. Under that configuration, the process-global authentication logic in Server.ConfigureAPI() has already disabled Basic authentication for the shared internal request handler. The attacker sends an otherwise ordinary API request to a non-mTLS listener. Since no credential is requested or verified on that path, the request is admitted.

3) Credential bypass / access The attacker makes administrative API calls without credentials. No payload exploitation is required — the security control is simply absent. Any authenticated operation the Data Plane API normally permits is now reachable, including operations against the raw configuration endpoint.

4) Post-exploitation impact With full API administrative access the attacker can:

• Read sensitive, cleartext HAProxy configuration data via the raw configuration endpoint — exposing backend server addresses, credentials embedded in config, ACLs, TLS material references, and routing logic.
• Write/replace the managed configuration entirely via the raw configuration endpoint — enabling persistent manipulation of load balancer behavior, traffic redirection, or denial of service against all services fronted by the HAProxy instance.

Because the API routinely controls production load balancer state, successful exploitation is effectively control-plane compromise of the perimeter traffic path.

Impact Assessment

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, scoring 9.8 (Critical).

• AV:N (Network) — exploitation requires only network reachability to an affected HTTP or UNIX management endpoint.
• AC:L (Low) — no special conditions beyond the documented TLS CA + TLS port configuration are required; no race or timing dependency is described.
• PR:N (None) — no credentials are needed; the flaw is an authentication bypass.
• UI:N (None) — no user interaction.
• S:U (Unchanged) — impact remains within the vulnerable component's security scope.
• C:H / I:H / A:H — high confidentiality impact (disclosure of cleartext HAProxy configuration), high integrity impact (full configuration replacement), high availability impact (traffic-routing manipulation or denial of service).

Blast radius: Any organization running an affected Data Plane API version (2.2.0–3.4.3 or matching EE releases) and configured with both a TLS CA and a numeric TLS port. Organizations that terminate management traffic solely on a strictly mTLS-enforced listener and expose no HTTP/UNIX socket path would not be exploitable via those paths, but the described design shares the handler across listeners, so exposure depends on which transports are enabled.

Business impact: Loss of the load balancer control plane can redirect, intercept, blackhole, or expose traffic for every application behind the HAProxy instance. Exposed cleartext configuration may reveal upstream credentials and internal topology, enabling lateral movement.

Detection Guidance

Sigma Rule

title: HAProxy Data Plane API Unauthenticated Administrative Access (CVE-2026-109575)
id: 8f3c1a92-5b47-4d61-9e2a-c1d7f0a4b6e3
status: experimental
description: Detects successful administrative access to the HAProxy Data Plane API without authentication, consistent with CWE-306 authentication bypass on non-mTLS listeners.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109575
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: haproxy
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/v3/services/haproxy/configuration/raw'
      - '/v2/services/haproxy/configuration/raw'
      - '/services/haproxy/configuration'
  selection_write:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
      - 'DELETE'
  selection_no_auth:
    cs-Authorization: null
  condition: selection_endpoint and selection_write and selection_no_auth
falsepositives:
  - Legitimate automation on an intentionally unauthenticated internal listener
level: critical
tags:
  - attack.t1190
  - cve.2026.109575

YARA Rule

rule CVE_2026_109575_HAProxy_DataPlane_AuthBypass
{
    meta:
        description = "Detects HAProxy Data Plane API deployments vulnerable to CVE-2026-109575 authentication bypass (CWE-306)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109575"
        severity = "critical"

    strings:
        $api = "dataplaneapi" ascii nocase
        $cfg = "ConfigureAPI" ascii
        $tls_ca = "tls_ca" ascii
        $tls_port = "tls_port" ascii
        $requi = "RequireAndVerifyClientCert" ascii
        $raw = "configuration/raw" ascii nocase

    condition:
        uint16(0) == 0x2131 or
        ( ($api or $raw) and ($tls_ca and $tls_port) ) or
        ( $cfg and ($requi or $tls_ca) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109575 HAProxy Data Plane API unauthenticated config access"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/services/haproxy/configuration/raw"; nocase; http.header; content:"Authorization"; negated; reference:cve,2026-109575; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109575; classtype:attempted-admin; sid:2026109575; rev:1;)

Elastic Detection

any where
  (http.request.method in ("POST", "PUT", "PATCH", "DELETE")) and
  (http.request.uri contains "/services/haproxy/configuration/raw" or
   http.request.uri contains "/services/haproxy/configuration") and
  (not http.request.headers.authorization : *)

Splunk SPL Query

index=web OR index=haproxy
| eval uri=coalesce(uri, cs_uri_stem, url)
| eval method=coalesce(http_method, cs_method, method)
| where (match(uri, "services/haproxy/configuration")) AND (match(method, "POST|PUT|PATCH|DELETE"))
| eval auth=coalesce(authorization, cs_Authorization, http_authorization, "")
| where auth=""
| stats count values(uri) as uris by src_ip, method
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="haproxy,web,cve-2026-109575,">
  <rule id="2026109" level="12">
    <decoded_as>json</decoded_as>
    <field name="uri">/services/haproxy/configuration/raw</field>
    <regex field="http_method">^POST$|^PUT$|^PATCH$|^DELETE$</regex>
    <description>CVE-2026-109575: Unauthenticated HAProxy Data Plane API administrative configuration access attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109575,authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate mitigations

• Disable or remove plain HTTP and UNIX domain socket listeners from the Data Plane API wherever possible; expose management exclusively via a listener that enforces mTLS.
• Restrict network reachability of the management API to a dedicated management VLAN / jump host; block from untrusted and internet-facing networks.
• Where the HTTP or UNIX socket path cannot be disabled, front the management API with a reverse proxy or network ACL enforcing authentication and source-IP allow-listing.
• Audit current configuration for the tls_ca + numeric tls_port combination that triggers the global authentication drop.
• Treat any exposed cleartext HAProxy configuration as potentially disclosed; rotate any credentials or secrets referenced in that configuration.

2) Patch / upgrade steps

• Upgrade to a fixed release: 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, or the corresponding Enterprise Edition backport. These releases migrate authentication to the per-request TLS connection-state validation model that resolves the shared-handler fail-open condition.
• As patch evidence is currently unavailable from tracked sources, verify the fixed version against the vendor's official release notes before deployment, and validate post-upgrade that non-TLS listeners no longer admit unauthenticated requests.

3) Long-term hardening

• Adopt a defense-in-depth model for management planes: never rely on a single transport for authentication enforcement.
• Prefer per-request authentication/authorization checks over process-global toggles in any management API design.
• Continuously monitor for unauthenticated administrative calls and alert on any write to the raw configuration endpoint.
• Maintain an inventory of Data Plane API instances and their exposed transports; enforce strict listener hygiene.

References

• NVD — CVE-2026-109575: https://nvd.nist.gov/vuln/detail/CVE-2026-109575
• HAProxy Data Plane API documentation and release notes: https://www.haproxy.com/documentation/dataplaneapi/
• HAProxy Enterprise Edition advisories: https://www.haproxy.com/products/haproxy-enterprise-edition
• CWE-306 — Missing Authentication for Critical Function: https://cwe.mitre.org/data/definitions/306.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no Nuclei template, and no evidence of active exploitation campaigns at the time of writing. EPSS not yet scored by FIRST.org.