HAProxy Data Plane API Critical Auth Bypass CVE-2026-109575 Fixed

HAProxy has released fixes for a critical authentication bypass vulnerability in its Data Plane API. The flaw, tracked as CVE-2026-109575, allows unauthenticated attackers to gain full administrative access to the management interface. This issue affects both Community and Enterprise Edition releases up to version 3.4.3.

The vulnerability stems from improper handling of security controls within the Server.ConfigureAPI() function. According to the National Vulnerability Database, the flaw is rated 9.8 on the CVSS scale, which classifies it as critical. It involves a process-global logic error that drops authentication requirements across multiple transport types under specific conditions.

Context and Background

The issue occurs when an administrator configures a TLS Certificate Authority (tls_ca) and specifies a numeric TLS port (tls_port). Under these settings, the application globally disables Basic authentication on its shared internal request handler. This handler serves HTTP, HTTPS, and UNIX domain socket listeners concurrently, creating a broad attack surface.

Mutual TLS client certificate verification is enforced exclusively on the HTTPS server path. Consequently, all other simultaneously active non-mTLS listeners fail open because the global authentication state has been disabled. An attacker does not need to exploit the HTTPS path to gain access.

An unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can bypass credentials entirely. This grants full API administrative access without authentication. The vulnerability allows remote or local actors to interact with the management interface as if they were authorized administrators.

Attackers can read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This capability poses a significant risk to infrastructure integrity, as an attacker could modify load balancing rules or other critical settings. The flaw is categorized under CWE-306, which relates to incorrect default permissions.

Who Is Affected

The vulnerability impacts HAProxy Data Plane API Community Edition versions up to 2.9.28, 3.0.24, 3.2.16, and 3.3.8. Enterprise Edition users are also affected, with versions up to 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1 vulnerable.

HAProxy has addressed the issue by migrating to a per-request TLS connection-state validation model. This change ensures that authentication controls are not globally disabled when TLS settings are configured. The fix prevents the failure-open behavior that allowed unauthenticated access to HTTP and UNIX endpoints.

Patches are available in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, and 2.9.29. Corresponding Enterprise Edition backports have also been released. Users running any of the affected versions should upgrade to one of these patched releases to mitigate the risk.

What should you do?

Administrators should immediately verify their current Data Plane API version against the affected list. If running a vulnerable version, prioritize upgrading to the latest patched release. Organizations should also review access logs for any unauthorized administrative actions or configuration changes.