A process‑global authentication flaw in HAProxy Data Plane API 2.2.0 through 3.4.3 removes Basic authentication on all shared internal request handlers when a TLS certificate authority and port are configured. Because the shared handler serves HTTP, HTTPS, and UNIX domain socket listeners, only the HTTPS path correctly enforces client certificate authentication; the other listeners remain open. As a result, an attacker who can reach an HTTP or UNIX management endpoint can bypass credentials entirely and obtain full administrative access to the API, allowing the attacker to read or replace HAProxy configuration data in cleartext.

The vulnerability affects the HAProxy Data Plane API Community Edition and Enterprise Edition in release series 2.2.0–3.4.3. The affected components include every HTTP, HTTPS, and UNIX domain socket listener that exposes the management API. The issue was fixed in HAProxy releases 3.4.4, 3.3.9, 3.2.17, 3.0.25, 2.9.29 and their corresponding Enterprise Edition backports.

With its CVSS score of 9.8, this issue is rated as critical. Although the EPSS score is not available, the lack of authentication on active listeners makes exploitation straightforward from any network segment that can reach the API. An attacker could be remote on the public network or local through a compromised host that can access the UNIX socket. The vulnerability is not listed in the CISA KEV catalog yet, but the potential loss of confidentiality, integrity, and availability justifies prompt mitigation.