CVE-2026-49331 Details
Description
A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream application without stripping them. An unauthenticated attacker can inject forged identity headers on whitelisted paths.
A vulnerability exists in OpenShift OAuth Proxy, specifically in the 'skip-auth-regex' paths that bypass authentication. The proxy forwards client-supplied identity headers, including X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Access-Token, to upstream applications without removing them. This flaw allows an unauthenticated attacker to inject fake identity headers on whitelisted paths, potentially leading to audit log manipulation and authorization bypass.
Review and reduce 'skip-auth-regex' configurations. Implement middleware in upstream applications to disregard the X-Forwarded-User header on unauthenticated paths.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-49331 | [email protected] | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2483252 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | [email protected] |