CVE-2022-1677

6.3 mediumEPSS 0.6%

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

Severity

CVSS 3.1

6.3 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2022-09-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:openshift_container_platform

References

https://access.redhat.com/security/cve/CVE-2022-1677
https://bugzilla.redhat.com/show_bug.cgi?id=2076211
https://access.redhat.com/security/cve/CVE-2022-1677
https://bugzilla.redhat.com/show_bug.cgi?id=2076211

Check your stack JSON