Red Hat Connectivity Link: Policy bypass via crafted HTTPRoute match values
Summary
The Kuadrant operator shipped in Red Hat Connectivity Link and Red Hat OpenShift AI does not correctly escape values from HTTPRoute path, header and query match fields when it generates the CEL predicate. A user who can create or modify an HTTPRoute attached to a shared Gateway can craft a match value that makes the predicate skip Gateway-level authentication and rate limiting. The request is still forwarded to the route's backend. The attack needs authenticated, route-write access to the cluster.
Affected
- Red Hat Connectivity Link 1.4 and 1.5, according to the CVE record.
- Red Hat OpenShift AI (RHOAI), according to the CVE record.
- Exact affected version ranges: Unknown.
Fixed in
- Unknown. The RHSA pages do not list fixed versions (Fixes: none).
- Red Hat errata RHSA-2026:83531 (Connectivity Link 1.4) and RHSA-2026:88203 (Connectivity Link 1.5) contain updated container images. Check them for the fixed versions.
- Upstream fix: kuadrant-operator commit 7e667dc216e6ad38feaeadb391da59aa0380057a (pull request #2372).
Workaround
- Restrict who can create or modify HTTPRoutes attached to shared Gateways (Kubernetes RBAC).
- Review existing routes on shared Gateways for unusual path, header or query match values.
- Enforce authentication and rate limiting at the backend as a compensating control.
- These measures reduce exposure but do not fix the component.
Exploitation
- No evidence of exploitation in the wild found at the time of writing.
- No public proof of concept found at the time of writing.
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
Our recommendation
- If you run OpenShift, Red Hat Connectivity Link or RHOAI, check whether you use the Kuadrant operator with shared Gateways.
- Apply the fixed versions from RHSA-2026:83531 or RHSA-2026:88203 as soon as they are available for your release.
- Restrict HTTPRoute write access now and review routes on shared Gateways.
- Monitor the advisories for exploitation or a public proof of concept.
- No action needed if you do not use these products.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat Security Advisory RHSA-2026:83531 access.redhat.com
- Red Hat Security Advisory RHSA-2026:88203 access.redhat.com
- Red Hat CVE record CVE-2026-108334 access.redhat.com
- Red Hat Bugzilla 2548768 bugzilla.redhat.com
- GitHub Advisory GHSA-fcw2-f6v9-6ffp github.com
- Kuadrant operator fix commit 7e667dc github.com
- Kuadrant operator pull request #2372 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 01:02.
Original description (NVD)
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.
NVD references (6)
- https://access.redhat.com/errata/RHSA-2026:83531
- https://access.redhat.com/errata/RHSA-2026:88203
- https://access.redhat.com/security/cve/CVE-2026-108334
- https://bugzilla.redhat.com/show_bug.cgi?id=2548768
- https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a
- https://github.com/advisories/GHSA-fcw2-f6v9-6ffp
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.