{"id":"CVE-2026-108334","title":"A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator","summary":"A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly esca…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","cwe":["CWE-917"],"vendor":"Red Hat","product":"rhcl-1/developer-portal-controller-rhel9","affected":["rhcl-1/developer-portal-controller-rhel9 (all versions)","rhcl-1/rhcl-operator-bundle (all versions)","rhcl-1/rhcl-rhel9-operator (all versions)","rhoai/odh-model-controller-rhel9 (all versions)","rhoai/odh-model-serving-api-rhel9 (all versions)"],"published":"2026-10-15","updated":"2026-10-15","sourceUpdated":"2026-10-15T19:17:20.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-108334","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-108334","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548768","label":"secalert@redhat.com"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-10-15T19:25:46.398Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-15T20:08:09.050952Z"},"slug":"CVE-2026-108334","body":"## Overview\n\nA flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}