Unauthenticated HAProxy API Access Risks Config Theft and Remote Control
A critical flaw in HAProxy Data Plane API allows attackers to bypass authentication and gain full administrative control over proxy configurations.
Key points
- CVE-2026-109575 is rated CVSS 9.8 Critical by the NVD.
- The flaw affects HAProxy Data Plane API versions up to 3.4.3.
- Patches are available in versions 3.4.4 and earlier branch updates.
Organisations using HAProxy Data Plane API face immediate risk from a critical authentication bypass that grants unauthenticated users full administrative access. The vulnerability, tracked as CVE-2026-109575, allows attackers to read sensitive configuration data or replace it entirely without providing credentials. This exposure occurs when specific TLS settings are active on the management interface.
How it unfolded
- The vulnerability exists in the Server.ConfigureAPI function within HAProxy Data Plane API.
- It affects versions 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases.
- The flaw arises when a TLS Certificate Authority and numeric TLS port are configured.
Who is affected
The issue impacts both Community and Enterprise Editions of HAProxy Data Plane API. According to the NVD record, affected Enterprise versions include those up to 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1. Community Edition users running versions up to 2.9.28, 3.0.24, 3.2.16, and 3.3.8 are also vulnerable. The flaw is classified under CWE-306, indicating improper handling of security controls.
The vulnerability stems from process-global authentication logic that incorrectly disables security controls across multiple transport types. When mutual TLS verification is enforced on the HTTPS path, the shared internal request handler fails to apply Basic authentication to HTTP and UNIX domain socket listeners. This causes non-mTLS endpoints to fail open, allowing unauthenticated access.
An attacker reaching an affected HTTP or UNIX management endpoint can bypass credentials entirely. This grants full API administrative access, enabling the theft of cleartext configuration data or the replacement of managed configurations via raw endpoints. The risk applies to both remote and local actors who can reach these management interfaces.
The fix
HAProxy has released patches to address CVE-2026-109575. The vulnerability is fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, and 2.9.29. Respective Enterprise Edition backports are also available. The fix migrates the system to a per-request TLS connection-state validation model, ensuring authentication controls are applied correctly regardless of the transport type used.
What to do and how to stay safe: HAProxy
- Identify all instances of HAProxy Data Plane API running vulnerable versions listed in the advisory.
- Restrict network access to management endpoints to trusted administrative networks only.
- Monitor logs for unauthenticated access attempts to HTTP or UNIX socket listeners.
- Apply the vendor-provided patches once verified for compatibility with your environment.
Step-by-step guide: Patch Management: Eight Questions Answered for Stability
General security guidance from the Malware Brief newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which HAProxy versions are vulnerable to CVE-2026-109575?
HAProxy Data Plane API versions 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases up to 3.3.8-ee1 are affected.
What is the CVSS score for this vulnerability?
The NVD rates CVE-2026-109575 as CVSS 9.8, which is considered Critical severity.
How does the authentication bypass occur?
Configuring a TLS CA and port causes the system to globally disable Basic auth on shared handlers, leaving HTTP and UNIX sockets unprotected.
