CVE-2026-108334
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator.
Impact
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://access.redhat.com/errata/RHSA-2026:83531
- https://access.redhat.com/errata/RHSA-2026:88203
- https://access.redhat.com/security/cve/CVE-2026-108334
- https://bugzilla.redhat.com/show_bug.cgi?id=2548768
- https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a
- https://github.com/advisories/GHSA-fcw2-f6v9-6ffp