One TLS setting turned off Basic auth for every HAProxy Data Plane API listener

Configuration management APIs are usually the most privileged HTTP endpoints an organisation runs. The HAProxy Data Plane API edits the load balancer's configuration, which means it can redirect traffic, disable access controls, and rewrite the front door of a production estate. CVE-2026-109575 describes a case where enabling one legitimate TLS option silently removed authentication from the rest of the process.

The affected surface

The CVE record covers HAProxy Data Plane API community versions 2.2.0 through 3.4.3 and the corresponding Enterprise Edition releases. The fix is in v3.4.4, published in the haproxytech/dataplaneapi repository.

The severity is 9.8 under CVSS 3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H , with no privileges required and no user interaction.…