How Does a TLS Config Mistake Break HAProxy Data Plane API Auth?

HAProxy Data Plane API contains a critical authentication bypass vulnerability, tracked as CVE-2026-109575. The flaw stems from improper security control handling within the Server.ConfigureAPI() function. According to the National Vulnerability Database, this issue allows attackers to gain full administrative access without valid credentials.

Root cause

The vulnerability arises when administrators configure a TLS Certificate Authority (tls_ca) and specify a numeric TLS port (tls_port). In this state, the application globally disables Basic authentication on its shared internal request handler. This handler serves HTTP, HTTPS, and UNIX domain socket listeners concurrently. The system enforces mutual TLS (mTLS) client certificate verification only on the HTTPS server path. Consequently, the global disabling of Basic auth causes all other active non-mTLS listeners to fail open. This design flaw means security controls are dropped across multiple transport types simultaneously.

Attack path

An unauthenticated attacker with network access to an affected HTTP or UNIX management endpoint can exploit this bypass. Because the non-mTLS listeners fail open, the attacker does not need valid credentials. According to the NVD record, this allows remote or local actors to read sensitive, cleartext HAProxy configuration data. Attackers can also replace the managed configuration entirely via the raw configuration endpoint. This grants full API administrative access without triggering standard authentication checks.

Affected versions

The National Vulnerability Database lists the following affected components:

• HAProxy Data Plane API Community Edition versions 2.2.0 through 3.4.3.
• HAProxy Data Plane API Enterprise Edition releases up to 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1.
• Specific CE versions up to 2.9.28, 3.0.24, 3.2.16, and 3.3.8 are also vulnerable.

Mitigation

The vendor has released patches that migrate to a per-request TLS connection-state validation model. This change ensures authentication logic is not globally disabled when mutual TLS is configured. Administrators should update to the following fixed versions:

• Version 3.4.4 and later for the 3.4 branch.
• Version 3.3.9 and later for the 3.3 branch.
• Version 3.2.17 and later for the 3.2 branch.
• Version 3.0.25 and later for the 3.0 branch.
• Version 2.9.29 and later for the 2.9 branch.

What to do and how to stay safe: HAProxy

• Audit your HAProxy Data Plane API installations to identify if they fall within the affected version ranges.
• Check configuration files for the presence of tls_ca and numeric tls_port settings, which trigger the vulnerable behavior.
• Apply the latest vendor-provided updates to ensure the per-request validation model is active on your systems.
• Monitor access logs for unauthorized attempts to reach HTTP or UNIX management endpoints, which may indicate exploitation.

Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures

General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109575?

The National Vulnerability Database rates CVE-2026-109575 as CVSS 9.8, which is classified as Critical.

Which HAProxy versions are not affected by this vulnerability?

Versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, and 2.9.29, along with their respective Enterprise Edition backports, are fixed.

How does the authentication bypass occur technically?

Configuring mutual TLS causes the application to globally disable Basic authentication on a shared handler, making non-TLS listeners fail open.