CVE-2018-11469: Incorrect caching of responses to requests including an Authorization header in HAProxy 1.8.0 through 1.8.9...

Security readout for executives and security teams

HAProxy 1.8.0 through 1.8.9 can incorrectly cache responses tied to Authorization headers when its cache is enabled. An unauthenticated remote user could receive information meant for an authenticated user. The business risk depends on whether HAProxy caching is used in front of protected applications. Exposure is likely limited to deployments running HAProxy 1.8.0 through 1.8.9 with the HAProxy cache feature enabled in front of authenticated content. Systems without HAProxy caching, outside this version range, or not proxying Authorization-based routes are less likely affected. Prioritize remediation where HAProxy cache fronts authenticated applications, because private user or customer data could be exposed without login. Treat internet-facing affected proxies as higher urgency, but evidence supplied does not support calling this actively exploited. Mitigation focus: Inventory HAProxy versions and identify any 1.8.0 through 1.8.9 deployments.; Determine whether HAProxy cache is enabled on those deployments.; Apply HAProxy or distribution updates addressing CVE-2018-11469..

Prepared

Jun 7, 2026, 13:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.