{"id":"CVE-2026-109575","published":"2026-10-12T20:17:09.443","lastModified":"2026-10-16T19:55:59.740","description":"In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://github.com/haproxytech/dataplaneapi/commit/c3ae4e3ccff5490d44650565e445c4b15e8aff8c","tags":[]},{"url":"https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.4","tags":[]},{"url":"https://www.haproxy.com/documentation/haproxy-data-plane-api/","tags":[]},{"url":"https://www.haproxy.com/documentation/haproxy-data-plane-api/community/changelog/#version-3.4","tags":[]}],"exploitRefs":[{"url":"https://github.com/haproxytech/dataplaneapi/commit/c3ae4e3ccff5490d44650565e445c4b15e8aff8c","tags":[]},{"url":"https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.4","tags":[]}],"hasPoc":true,"ai":{"summary":"HAProxy Data Plane API suffers from a critical authentication bypass vulnerability where process-global authentication logic fails to properly secure multiple transport types, allowing unauthenticated access to administrative APIs when TLS is configured with numeric ports. This affects HTTP and UNIX domain socket listeners that should require authentication but fail open due to shared internal request handlers.","exploitability":"Exploitation is straightforward for attackers who can reach HTTP or UNIX management endpoints, requiring only basic network connectivity and no special credentials or preconditions beyond the vulnerable configuration.","blast_radius":"The vulnerability could allow unauthorized remote or local actors to gain full administrative access to HAProxy configurations, enabling them to read sensitive cleartext configuration data or replace managed configurations entirely across affected deployments.","remediation":"Upgrade to version 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, or their respective Enterprise Edition backports immediately.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","haproxy","config","api"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:47:24.780Z"}}