CVE-2026-108334

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator

Risk score: 50/100
CVSS: 7.4 v3.1
Exploit chance (30 days): 0.3%
Published: 15 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRout…
Affected: See advisory
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Why it is Yellow

CVSS 7.4 high

References

Original description

A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.

Last activity 15 Oct 2026. Patch Forecast updates every hour.