A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks.
The request is still forwarded to the route’s backend.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
red hat:red hat openshift ai (rhoai)
red hat:red hat connectivity link 1
References 4
https://access.redhat.com/security/cve/CVE-2026-108334
secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2548768
secalert@redhat.com
https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391…
secalert@redhat.com
https://github.com/advisories/GHSA-fcw2-f6v9-6ffp
secalert@redhat.com