CVE-2026-108334: Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-23
Weakness: CWE-917

Description

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

Affected products

Red Hat Connectivity Link 1.4: all versions — fixed in 1791975888
Red Hat Connectivity Link 1.5: all versions — fixed in 1792512519

How to fix

Upgrade to a fixed version: Red Hat Connectivity Link 1.4 1791975888; Red Hat Connectivity Link 1.5 1792512519. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-108334 or the next vulnerability affects your stack