CVE-2022-1677

In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

• CWE-400

• https://access.redhat.com/security/cve/CVE-2022-1677Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2076211Issue Tracking, Patch, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2022-1677Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2076211Issue Tracking, Patch, Vendor Advisory

Published

Sep 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1670When generating a user invitation code in Octopus Server, th…7.5
• CVE-2022-1671A NULL pointer dereference flaw was found in rxrpc_preparse_…7.1
• CVE-2022-1672The Insights from Google PageSpeed WordPress plugin before 4…8.8
• CVE-2022-1673The WooCommerce Green Wallet Gateway WordPress plugin before…6.1
• CVE-2022-1674NULL Pointer Dereference in function vim_regexec_string at r…5.5
• CVE-2022-1676Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-1678An issue was discovered in the Linux Kernel from 4.18 to 4.1…7.5
• CVE-2022-1679A use-after-free flaw was found in the Linux kernel’s Athero…7.8
• CVE-2022-1680An account takeover issue has been discovered in GitLab EE a…8.8
• CVE-2022-1681Authentication Bypass Using an Alternate Path or Channel in …7.2
• CVE-2022-1682Reflected Xss using url based payload in GitHub repository n…6.1
• CVE-2022-1683The amtyThumb WordPress plugin through 4.2.0 does not saniti…8.8