CVE-2026-46579

HighCVSS 7.4

Published: 29/05/2026(UTC)Updated: 07/09/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

In OpenShift Router, when a Route has insecureEdgeTerminationPolicy set to Allow, the HTTP frontend does not remove X-SSL-Client-* headers from incoming requests. An unauthenticated attacker can send crafted HTTP requests with fake headers, bypassing mutual TLS authentication and impersonating client certificate identities.

Risk Assessment

An attacker can gain unauthorized access to backends relying on X-SSL-Client-* headers for authentication, leading to security breaches and potential resource takeover.

Recommendation

Apply the patch from Red Hat for OpenShift Router or configure firewall rules to block dangerous headers.

Other vulnerabilities in OpenShift Router

CVE-2026-42965High
A flaw in OpenShift Router allows a user with EndpointSlice write access to create a Service backed by an FQDN EndpointSlice that resolves to a cloud metadata endpoint. The router then proxies requests to this endpoint, leading to disclosure of instance credentials and other sensitive metadata. This bypasses previous IP address validation security measures.

Original NVD description (English source)

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.