Server Configuration Vulnerability in HAProxy Data Plane API

CVE-2026-109575

What is CVE-2026-109575?

A vulnerability exists in HAProxy Data Plane API versions 2.2.0 to 3.4.3 that allows unauthorized access due to flawed authentication controls. The misconfiguration of the Server.ConfigureAPI() function leads to inadequate security measures when using certain TLS settings. Specifically, when a TLS Certificate Authority and a numeric TLS port are configured, Basic authentication gets inadvertently disabled across shared internal request handlers. As a result, an attacker can interact with affected HTTP or UNIX management endpoints without valid credentials, thus gaining full administrative access to the API. Sensitive configuration data could be accessed or modified without authorization. The issue has been addressed in versions 3.4.4 and onwards by implementing a more robust per-request connection state validation.

References