CVE-2026-109575: HAProxy Data Plane API EE vulnerability

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

Description quoted from the CVE record (assigned by mitre, published 2026-10-12).

Weakness: CWE-306 Missing Authentication for Critical Function

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 5 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 8 references on Exploit Observer

Live scores

EPSS: 0.004
low predicted chance of attack
VEDAS: 0.987
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei · Suricata

Who is affected

Product	Affected	Not affected
HAProxy Data Plane API EE (dataplaneapi)	from 2.2.0-ee1 up to and including 2.9.28-ee1 from 3.0-ee up to and including 3.0.24-ee1 from 3.1-ee up to and including 3.2.16-ee1 from 3.3-ee up to and including 3.3.8-ee1 from 3.4-ee up to and including 3.4.3-ee2	Not stated
HAProxy Data Plane API CE (dataplaneapi-ee)	from 2.2.0 up to and including 2.9.28 from 3.0.0 up to and including 3.0.24 from 3.1.0 up to and including 3.2.16 from 3.3.0 up to and including 3.3.8 from 3.4.0 up to and including 3.4.3	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.

How to detect it

Nuclei template (active check)

HAProxy Data Plane API - Authentication Bypass
HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) share a single internal request handler across their HTTP, HTTPS and UNIX socket listeners. When a TLS CA (tls_ca) and a numeric tls_port are configured, Server.ConfigureAPI() globally disables Basic authentication on that shared handler, while mutual-TLS client-certificate verification is enforced only on the HTTPS path. As a result every non-mTLS listener fails open and an unauthenticated attacker reaching an affected HTTP management endpoint gains full API administrative access. This template sends an unauthenticated GET to the raw configuration endpoint; a vulnerable instance returns the full HAProxy configuration (200 with a Configuration-Checksum header) instead of 401.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /v3/services/haproxy/configuration/raw); it decides using status, word matchers. Severity in the template: critical. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-109575.yaml

Show the template (44 lines)

yaml

id: CVE-2026-109575

info:
  name: "HAProxy Data Plane API - Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) share a
    single internal request handler across their HTTP, HTTPS and UNIX socket listeners. When a TLS CA
    (tls_ca) and a numeric tls_port are configured, Server.ConfigureAPI() globally disables Basic
    authentication on that shared handler, while mutual-TLS client-certificate verification is enforced
    only on the HTTPS path. As a result every non-mTLS listener fails open and an unauthenticated
    attacker reaching an affected HTTP management endpoint gains full API administrative access. This
    template sends an unauthenticated GET to the raw configuration endpoint; a vulnerable instance
    returns the full HAProxy configuration (200 with a Configuration-Checksum header) instead of 401.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-109575&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=haproxy&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-109575
    cwe-id: CWE-306
  metadata:
    verified: false
    max-request: 1
  tags: cve,cve2026,haproxy,dataplaneapi,auth-bypass

http:
  - raw:
      - |
        GET /v3/services/haproxy/configuration/raw HTTP/1.1
        Host: {{Hostname}}
        Accept: text/plain

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: word
        part: header
        words:
          - "Configuration-Checksum"

CVE-2026-109575.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-109575 HAProxy Data Plane API - Authentication Bypass. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-109575 HAProxy Data Plane API - Authentication Bypass"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/services/haproxy/configuration/raw"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-109575; reference:url,https://www.exploit.observer/?keyword=CVE-2026-109575&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=haproxy&match=exact; sid:1076200; rev:1;)

CVE-2026-109575.rules on GitHub

References

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.