All vulnerabilities
CVE-2026-108334GHSA-fcw2-f6v9-6ffp

Red Hat Connectivity Link 1.4: Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides

Red Hat Red Hat Connectivity Link 1.4Operating systems
Open in ThreatlineRecord JSON
CVSS
7.4High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published15 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

Text from CVE List

Affected versions 2

  • Red Hat Connectivity Link 1.4unaffected: 1791975888 and laterCVE List
  • Red Hat Connectivity Link 1.5unaffected: 1792512519 and laterCVE List

References 6