CVE-2026-109575

Name of the Vulnerable Software and Affected Versions HAProxy Data Plane API versions 2.2.0 through 2.9.28 HAProxy Data Plane API versions 3.0.0 through 3.0.24 HAProxy Data Plane API versions 3.1.0 through 3.2.16 HAProxy Data Plane API versions 3.3.0 through 3.3.8 HAProxy Data Plane API versions 3.4.0 through 3.4.3

Description An authentication bypass exists in the Server.ConfigureAPI() function due to process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls ca) is configured and a numeric TLS port (tls port) is specified, Basic authentication is globally disabled on the shared internal request handler. While mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced on the HTTPS server path, other active non-mTLS listeners, such as HTTP or UNIX domain sockets, fail open. This allows an unauthenticated attacker with access to these endpoints to gain full API administrative access, enabling them to read sensitive cleartext configuration data or replace the managed configuration entirely via the raw configuration endpoint.

Recommendations Update HAProxy Data Plane API version 2.9.28 to 2.9.29. Update HAProxy Data Plane API version 3.0.24 to 3.0.25. Update HAProxy Data Plane API version 3.2.16 to 3.2.17. Update HAProxy Data Plane API version 3.3.8 to 3.3.9. Update HAProxy Data Plane API version 3.4.3 to 3.4.4. Restrict management interfaces to trusted networks. Disable unnecessary HTTP and UNIX-socket listeners. Verify authentication independently on every enabled management transport.