HAProxy Data Plane API TLS Flaw Disables Global Auth in Critical CVE-2026-109575; Patches Now Available

HAProxy Data Plane API contains a critical authentication bypass flaw that allows attackers to access administrative functions without credentials. The issue arises when specific TLS settings are configured, causing the application to disable security controls across all connection types simultaneously.

Root cause

The vulnerability stems from how Server.ConfigureAPI() handles authentication logic in affected versions. According to the NVD record, when a TLS Certificate Authority and a numeric TLS port are specified, the application globally disables Basic authentication. This change applies to the shared internal request handler used by HTTP, HTTPS, and UNIX domain socket listeners.

Attack path

Mutual TLS verification is enforced only on the HTTPS server path. Because the authentication logic is process-global, all other active listeners, including HTTP and UNIX sockets, fail open. An unauthenticated attacker reaching an affected endpoint can bypass credentials entirely. This grants full API administrative access, allowing them to read sensitive configuration data or replace the managed configuration.

Affected versions

The flaw impacts HAProxy Data Plane API Community Edition versions 2.2.0 through 3.4.3. It also affects Enterprise Edition releases up to 2.9.28-ee1, 3.0.24-ee1, 3.2.16-ee1, and 3.3.8-ee1. The weakness is classified as CWE-306, improper handling of authentication.

Mitigation

The vendor has released patches that migrate to a per-request TLS connection-state validation model. Users should update to version 3.4.4, 3.3.9, 3.2.17, 3.0.25, or 2.9.29. Corresponding Enterprise Edition backports are also available. No other mitigations are confirmed in the source material.

Why it matters

Teams usually assume that securing one protocol, such as HTTPS, protects the entire service. This incident shows that shared internal handlers can propagate configuration errors across different transport types. Security operations groups should check whether authentication logic is isolated per-connection or shared globally. Verifying that non-TLS endpoints remain protected even when TLS features are enabled is a standard best practice for API security.

What to do and how to stay safe: HAProxy

• Verify the installed version of HAProxy Data Plane API against the affected list.
• Apply the latest vendor patches to restore per-request authentication validation.
• Review network access controls to restrict HTTP and UNIX socket endpoints.
• Monitor logs for unauthenticated requests to management interfaces.

Step-by-step guide: Security Advisories: 6 Common Misreadings That Leave Systems Exposed

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is this vulnerability being actively exploited in the wild?

The source material does not state whether the flaw is currently being exploited by threat actors.

Which CVE ID corresponds to this authentication bypass?

The vulnerability is tracked as CVE-2026-109575 with a CVSS score of 9.8.

Does this affect only the Community Edition of HAProxy?

No, the flaw affects both Community Edition and Enterprise Edition releases within the specified version ranges.