Key points
- CVE-2026-109575 carries a CVSS score of 9.8 and affects Data Plane API versions up to 3.4.3.
- The vulnerability arises when a TLS certificate authority and numeric port are configured, disabling Basic auth globally.
- Fixed releases are available for Community and Enterprise Editions, starting from version 3.4.4.
Security operations teams must address a critical authentication bypass in HAProxy Data Plane API immediately. The flaw, tracked as CVE-2026-109575, allows attackers to gain full administrative access without credentials. This occurs when specific Transport Layer Security settings are active on the management interface.
According to the National Vulnerability Database, the issue stems from how the application handles security controls across different transport types. When an administrator configures a TLS Certificate Authority alongside a numeric TLS port, the system incorrectly disables Basic authentication on its shared internal request handler. This handler serves HTTP, HTTPS, and UNIX domain socket listeners simultaneously.
Context and technical background
The vulnerability exists because mutual TLS client certificate verification is enforced exclusively on the HTTPS server path. Consequently, other active listeners, such as HTTP or UNIX sockets, fail open due to the global drop in security controls. This means an unauthenticated attacker reaching an affected endpoint can bypass credentials entirely.
The flaw allows remote or local actors to read sensitive configuration data in cleartext. Attackers can also replace the managed configuration entirely via the raw configuration endpoint. The vendor has fixed this by migrating to a per-request TLS connection-state validation model, ensuring security controls are not dropped globally.
Affected software versions
This vulnerability impacts both Community and Enterprise Editions of HAProxy Data Plane API. Affected Community versions include releases up to 2.9.28, 3.0.24, 3.2.16, and 3.3.8. The flaw is present in any deployment within these version ranges that utilises the specified TLS configuration.
Enterprise Edition users are also at risk. Affected versions include 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1. Organisations running these specific builds must verify their TLS settings and update their software to mitigate the risk of unauthorised access to the management API.
Our take on the response
The release of patches for multiple version branches indicates a widespread impact across the product lifecycle. The fact that the fix involves changing the fundamental validation model suggests the previous architecture was inherently flawed for mixed-transport environments. Teams should prioritise updating to the latest secure versions to restore proper authentication boundaries.
What to do and how to stay safe: HAProxy
- Audit all HAProxy Data Plane API instances to identify if a TLS Certificate Authority and numeric port are currently configured.
- Restrict network access to HTTP and UNIX management endpoints to trusted internal networks only until patches are applied.
- Monitor API logs for unauthorised configuration changes or unexpected administrative access attempts from non-HTTPS sources.
- Plan immediate upgrades to the fixed versions listed in the vendor advisory to eliminate the global authentication bypass.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which HAProxy versions are affected by CVE-2026-109575?
Data Plane API versions 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases are affected.
How can an attacker exploit this vulnerability?
An attacker can access an HTTP or UNIX management endpoint to bypass credentials and gain full API administrative access.
Is there a patch available for this issue?
Yes, the vendor has released fixes in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, and 2.9.29, along with Enterprise backports.