The vulnerability occurs when control characters are allowed in redirect URL and prefix fields of the L7 policy in OpenStack Octavia. The RFC 3986 validator percent‑encodes these characters before validation, so newline and other control characters appear to be valid. Octavia then writes the raw, unencoded value directly into the HAProxy configuration used by the Amphora load‑balancer instance. An authenticated project member who owns a load balancer can use this flaw to inject arbitrary HAProxy directives, allowing the attacker to manipulate how traffic is routed or dropped, potentially leading to denial of service or additional configuration changes that affect the host environment.

OpenStack Octavia when using the Amphora provider. Versions prior to 18.0.1 are affected. The vulnerability does not apply to deployments that do not use the Amphora provider.

The CVSS score of 9.4 marks this as a critical flaw, and the EPSS score is not available, indicating uncertainty on current exploitation rates. The flaw is not listed in CISA’s KEV catalog. The attack requires an authenticated project member who owns a load balancer, so the vectors are primarily internal to the OpenStack deployment. An attacker can leverage the injection to modify HAProxy configuration, potentially disrupting load‑balancing services or enabling further compromise if the amphora host is reachable.