CVE Feed

    Dashboard / CVE / CVE-2026-108334

    CVE-2026-108334

    A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

    Published:Oct 15, 2026
    Last Modified:Oct 17, 2026
    EPS:Oct 15, 2026
    EPSS Score:0.00255
    CVSS Score:7.4

    Affected Products

    Vendor
    Redhat
    Product
    Connectivity Link
    Vendor
    Redhat
    Product
    Openshift Ai

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High