The vulnerability allows an authenticated project member who owns a TLS‑enabled load balancer in OpenStack Octavia to embed a newline and other control characters into a TLS cipher string. The field is written verbatim into HAProxy configuration generated on the Amphora, permitting arbitrary HAProxy directives to be injected. This can lead to execution of arbitrary commands, configuration changes, or other malicious effects. The flaw is a syntax injection in the TLS cipher field, identified as CWE‑94.

OpenStack Octavia users running a version older than 18.0.1 and using the Amphora provider driver. Only deployments that employ the Amphora provider are affected; the vulnerability does not apply to other load balancer drivers.

With a CVSS score of 9.4, this flaw is considered critical. The exploitability requires the attacker to have authenticated privileges to the project that owns the load balancer, but once that premise is met the attacker can directly manipulate the HAProxy configuration. No exploit probability score is available, and the vulnerability is not listed in the CISA KEV catalog, yet the high severity and confirmed ability to inject configuration directives indicate a real threat. Attackers could achieve control over the load balancer, potentially redirecting traffic or executing commands on the Amphora host.