CVE-2026-1095759.8CriticalCWE-306

CVE-2026-109575: HAProxy Data Plane API EE vulnerability

HAProxy · Data Plane API EE

Affected: HAProxy Data Plane API EE · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.4%probability of exploitation in the next 30 days

29th percentile

050100

Higher than 29% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority (tls_ca) is configured and a numeric TLS port (tls_port) is specified, the application globally disables Basic authentication on its shared internal request handler. Because this handler is shared concurrently among HTTP, HTTPS, and UNIX domain socket listeners, and mutual TLS (mTLS) client certificate verification (tls.RequireAndVerifyClientCert) is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open. Consequently, an unauthenticated attacker capable of reaching an affected HTTP or UNIX management endpoint can completely bypass credentials to gain full API administrative access. This allows unauthorized remote or local actors to read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint. This has been fixed in versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29, and their respective EE backports by migrating to a per-request TLS connection-state validation model.

Affected products2

From the CVE record. A product or version that is not listed is unknown, not unaffected.

HAProxy · Data Plane API EEfrom 2.2.0-ee1 up to and including 2.9.28-ee1; from 3.0-ee up to and including 3.0.24-ee1; from 3.1-ee up to and including 3.2.16-ee1; from 3.3-ee up to and including 3.3.8-ee1; from 3.4-ee up to and including 3.4.3-ee2
HAProxy · Data Plane API CEfrom 2.2.0 up to and including 2.9.28; from 3.0.0 up to and including 3.0.24; from 3.1.0 up to and including 3.2.16; from 3.3.0 up to and including 3.3.8; from 3.4.0 up to and including 3.4.3

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Missing Authentication · Authentication
Vendor: HAProxy
Published: October 2026
Band: Unlikely (under 1%), October 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-109575 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.