CVE-2026-33494 Details
Description
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.
A critical authorization bypass vulnerability has been identified in ORY Oathkeeper versions prior to 26.2.0. This vulnerability allows attackers to exploit HTTP path traversal sequences to access protected resources. The issue arises because the raw, un-normalized path is used for rule evaluation, enabling requests to bypass authentication requirements. For example, a request to '/public/../admin/secrets' can be matched against a permissive rule, allowing access to sensitive resources without proper authorization.
Upgrade ORY Oathkeeper to version 26.2.0 or later, where this vulnerability has been patched. As an additional precaution, normalize HTTP paths in the layers before Oathkeeper, using tools like Nginx or Envoy, which can automatically handle path normalization.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2 | [email protected] | Patch |
| https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ory oathkeeper | < 26.2.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 26, 2026 | New CVE Received | [email protected] |