CVE-2026-49332

HighCVSS 8.5

Published: 28/07/2026(UTC)Updated: 26/08/2026(UTC)Translated: 28/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

In openshift/oauth-proxy, the proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity.

Risk Assessment

An authenticated attacker can impersonate another user, gaining unauthorized access to resources or performing actions on behalf of another user.

Recommendation

Update openshift/oauth-proxy to a version that strips or ignores underscore-variant headers (X_Forwarded_User).

Other vulnerabilities in openshift/oauth-proxy

CVE-2026-49331Medium
A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream application without stripping them. An unauthenticated attacker can inject forged identity headers on whitelisted paths.

Original NVD description (English source)

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.