IT SBIT Services
Schneeberger
DEEN
CVE tracker

HAProxy Data Plane API: Authentication bypass on non-mTLS listeners

CVE-2026-109575Critical 9.8

← All vulnerabilities

Summary

A configuration error in HAProxy Data Plane API disables Basic authentication on all listeners when both tls_ca and a numeric tls_port are set. Plain HTTP and UNIX socket listeners that run at the same time then accept requests without credentials. An unauthenticated attacker who can reach such a listener gets full API administrative access and can read or replace the HAProxy configuration.

Affected

  • HAProxy Data Plane API Community Edition 2.2.0 through 3.4.3
  • HAProxy Data Plane API Enterprise Edition 2.2.0-ee1 through 3.4.3-ee2 (according to the CVE record)
  • Exposure requires tls_ca and a numeric tls_port configured together, plus an active plain HTTP or UNIX listener.

Fixed in

  • Community Edition: 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29
  • Enterprise Edition: corresponding EE backports; exact build numbers unknown, check the vendor bulletin or EE support.

Workaround

  • Disable the plain HTTP and UNIX listeners if an upgrade is not possible. This is the only documented mitigation.

Exploitation

  • No evidence of exploitation in the wild. CISA ADP does not list it as known exploited.
  • No public proof of concept found. CISA SSVC rates it as automatable with total technical impact.

Our recommendation

  • Inventory all Data Plane API instances, including containers and bundled controller builds.
  • Check whether tls_ca and tls_port are both set.
  • Update to a fixed version, or disable the HTTP and UNIX listeners.
  • After patching, verify that unauthenticated requests are refused on every listener.
  • Restrict network access to the management API and monitor configuration changes.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:11.

Original description (NVD)

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed