CVE-2026-108334CWE-917

CVE-2026-108334

High · published October 15, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00326 · 24.5th percentile
Weakness
CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Published
2026-10-15T23:17Z
References (6)
https://access.redhat.com/errata/RHSA-2026:83531 · [email protected]https://access.redhat.com/errata/RHSA-2026:88203 · [email protected]https://access.redhat.com/security/cve/CVE-2026-108334 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2548768 · [email protected]https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a · [email protected]https://github.com/advisories/GHSA-fcw2-f6v9-6ffp · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 15 OCT 18:44Z
    Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
    cvelistv5
  • 15 OCT 18:44Z
    Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
    cvelistv5