OpenShift Route HAProxy Configuration Injection Flaw

The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.

Casky was already ahead

This CVE exploits attack patterns that Casky's 215matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-1784 exposes a critical input validation weakness in OpenShift's Route resource, which uses HAProxy to expose Kubernetes pods at subdomains. The vulnerability stems from insufficient validation of the spec.path YAML parameter, allowing attackers to inject arbitrary HAProxy configuration directives. This affects any organization running OpenShift clusters where untrusted users can create or modify Route resources, potentially enabling traffic hijacking, credential theft, or denial of service. The high CVSS score of 8.8 reflects the ease of exploitation and significant impact on cluster security posture.

Casky.ai's 215 mapped skills detect this attack pattern by analyzing Resource Development (TA0006) techniques through Claude's extended reasoning capabilities. Practitioners using the platform would identify suspicious indicators including: malformed or oversized spec.path values that deviate from expected URL patterns, YAML injection attempts in Route manifests, unexpected HAProxy directives in configuration outputs, and lateral movement attempts following successful injection. The skills correlate configuration anomalies with CWE-15 (External Control of System or Configuration Setting) patterns, flagging Route definitions that bypass path normalization or contain special characters designed to break out of HAProxy context. Security teams gain visibility into both pre-exploitation indicators (suspicious YAML structure) and post-exploitation signals (unauthorized HAProxy rule modifications), enabling detection at multiple attack stages.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

215 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-1784.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

analyzing-office365-audit-logs-for-compromise

cloud security · low

Run

MITRE ATT&CK Techniques

TA0006

Investigate the attack patterns behind CVE-2026-1784

Casky has 215 skills that investigate the attack patterns behind CVE-2026-1784. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn