Why do specific TLS settings disable HAProxy Data Plane API authentication for critical CVE-2026-109575?

HAProxy has released updates to address a critical authentication bypass vulnerability in its Data Plane API. The flaw, identified as CVE-2026-109575, allows attackers to gain full administrative access without credentials. This occurs when specific Transport Layer Security configurations are active on the server.

How does the authentication bypass work?

The vulnerability stems from how the application handles global authentication logic. According to the National Vulnerability Database, the Server.ConfigureAPI() function improperly drops security controls across multiple transport types. This happens specifically when a TLS Certificate Authority is configured and a numeric TLS port is specified.

In these scenarios, the application globally disables Basic authentication on its shared internal request handler. This handler is used concurrently by HTTP, HTTPS, and UNIX domain socket listeners. Because mutual TLS client certificate verification is enforced exclusively on the HTTPS server path, all other simultaneously active non-mTLS listeners fail open.

What are the risks for administrators?

An unauthenticated attacker who can reach an affected HTTP or UNIX management endpoint can bypass credentials entirely. This grants them full API administrative access. Attackers can read sensitive, cleartext HAProxy configuration data or replace the managed configuration entirely via the raw configuration endpoint.

The impact is significant because it allows unauthorized remote or local actors to control the proxy configuration. This could lead to service disruption or data exposure if the configuration is altered. The flaw affects both Community Edition and Enterprise Edition releases of the Data Plane API.

Which versions are affected and fixed?

The vulnerability affects HAProxy Data Plane API versions 2.2.0 through 3.4.3. This range includes corresponding Enterprise Edition releases. Specifically, EE versions up to 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1 are impacted. Community Edition versions up to 2.9.28, 3.0.24, 3.2.16, and 3.3.8 are also affected.

Patches have been released to fix the issue. Users should update to versions 3.4.4, 3.3.9, 3.2.17, 3.0.25, or 2.9.29. Enterprise Edition users should apply the respective backports for these versions. The fix migrates the validation model to a per-request TLS connection-state approach.

What should developers do next?

Developers using HAProxy Data Plane API should immediately check their current version. If they are running an affected version, they should apply the available patch. Those who cannot patch immediately should restrict network access to the management endpoints. Disabling unused listeners can also reduce the attack surface until an update is applied.

What to do and how to stay safe: HAProxy

• Check your HAProxy Data Plane API version against the affected list.
• Apply the latest patch if you are running a vulnerable version.
• Restrict network access to HTTP and UNIX management endpoints.
• Monitor logs for unauthorized configuration changes or access attempts.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is CVE-2026-109575 being actively exploited?

The source material does not state whether the vulnerability is currently being exploited in the wild.

Does this affect all HAProxy installations?

No, it specifically affects the Data Plane API versions 2.2.0 through 3.4.3 and their EE counterparts.

How is the vulnerability fixed in the new versions?

The fix migrates to a per-request TLS connection-state validation model instead of a global one.