Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-108334
Red Hat Red Hat Connectivity Link 1.4 — Github.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overrides
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L L N C L L L 7.4 .0033 24.1 —
AFFECTED
Product Versions Fixed
Red Hat Connectivity Link 1.4 unspecified 1791975888
Red Hat Connectivity Link 1 unspecified —
Red Hat Connectivity Link 1 unspecified —
Red Hat OpenShift AI (RHOAI) unspecified —
Red Hat OpenShift AI (RHOAI) unspecified —
TIMELINE
Oct 9 Reserved by redhat
Oct 15 Published (CNA: redhat)
Oct 17 PATCH SHIPPED — CVE-2026-108334 (Red Hat Connectivity Link 1.4). Fixed in Red Hat Connectivity Link 1.4 1791975888.
Description
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 9, 2026 | Reserved | Reserved by redhat |
| October 15, 2026 | Published | Published (CNA: redhat) |
| October 17, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2026-108334 (Red Hat Connectivity Link 1.4). Fixed in Red Hat Connectivity Link 1.4 1791975888. |
Affected
Affected products and packages — 5 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Red Hat | Red Hat Connectivity Link 1.4 | — | — | 1791975888 |
| Red Hat | Red Hat Connectivity Link 1 | — | — | — |
| Red Hat | Red Hat Connectivity Link 1 | — | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108334 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
