#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL HAPROXY AUTHENTICATION BYPASS EXPOSES FULL PROXY CONFIGURATION CONTROL October 12, 2026 DISCLOSED BY: CVE Program / HAProxy maintainers PRODUCT: HAProxy Data Plane API — Community and Enterprise Editions CVE: CVE-2026-109575 SEVERITY: CRITICAL — CVSS 9.8 AFFECTED VERSIONS: 2.2.0–2.9.28 3.0.0–3.0.24 3.1.0–3.2.16 3.3.0–3.3.8 3.4.0–3.4.3 Corresponding vulnerable Enterprise builds. IMPACT: An authentication-control flaw can grant unauthenticated users full administrative access to the Data Plane API. Attackers reaching an affected management endpoint could read sensitive HAProxy configuration in plaintext or replace the managed configuration entirely, potentially redirecting traffic or disrupting services. EXPOSURE: The vulnerable configuration requires both tls_ca and a numeric tls_port, with an HTTP or UNIX-domain-socket management listener active. Mutual TLS protects the HTTPS listener, but authentication can be improperly disabled on other listeners sharing the same request handler. A reachable vulnerable management endpoint is required. EXPLOITATION STATUS: CONFIRMED CRITICAL AUTHENTICATION BYPASS. The flaw is established by the upstream security fix and published CVE record. No verified malicious exploitation in the wild or independently confirmed public working exploit. Forensic triage: Review Data Plane API access logs for unexpected configuration reads and writes. Investigate unauthorized raw-configuration updates, HAProxy reloads, unexplained frontend/backend changes and suspicious access to management listeners. No CVE-specific malicious IOCs have been published. URGENT ACTION: Upgrade to a fixed Data Plane API release: 2.9.29 / 3.0.25 / 3.2.17 / 3.3.9 / 3.4.4, or the corresponding fixed Enterprise build. Restrict management interfaces to trusted networks. Disable unnecessary HTTP and UNIX-socket listeners. Verify authentication independently on every enabled management transport. Audit configuration changes and rotate potentially exposed secrets if unauthorized access is suspected. SOURCE: https://github.com/haproxytech/dataplaneapi/commit/c3ae4e3ccff5490d44650565e445c4b15e8aff8c FIXED RELEASE: https://github.com/haproxytech/dataplaneapi/releases/tag/v3.4.4 OFFICIAL CVE: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/109xxx/CVE-2026-109575.json CONFIDENCE: HIGH — The official CVE record and HAProxy’s upstream corrective commit establish the vulnerability, affected configurations and remediation. Active exploitation remains unverified. #CyberSecurity #ThreatIntel #HAProxy #AuthenticationBypass #NetworkSecurity #VulnerabilityManagement