WebAssembly Shim Vulnerability in Kuadrant Operator
CVE-2026-108334
7.4HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 15 October 2026
What is CVE-2026-108334?
A flaw has been identified in the internal WebAssembly shim used by the Kuadrant operator, where it fails to correctly escape values from HTTPRoute match fields. This imperfection allows a user with the right access to create or modify an HTTPRoute associated with a shared Gateway. By providing crafted match values such as paths, headers, or query parameters, an attacker could bypass essential Gateway-level authentication and rate limiting checks. Consequently, potentially malicious requests may be forwarded to the route's backend without appropriate validation, posing significant security risks.
Affected Version(s)
Red Hat Connectivity Link 1.4 1791975888
Red Hat Connectivity Link 1.5 1792512519