Authenticated code execution via HAProxy config injection

Code execution in Red Hat OpenShift Container Platform allows remote authenticated users to inject router configuration via a crafted Route path. The Route spec.path value is passed into a plaintext HAProxy configuration template after insufficient validation, so attacker-controlled path text can break the intended directive structure and add HAProxy configuration. Exploitation requires permission to create or modify Routes, which Red Hat states is granted to the default Developer role, and the impact is on the shared openshift-ingress/router-default pods that consume the generated configuration.