CVE-2023-33189: Incorrect Authorization with specially crafted requests

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-30 · updated 2026-06-17
Weakness: CWE-285

Description

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.

Affected products

pomerium: before 0.17.4; from 0.19.0 before 0.19.2; from 0.21.0 before 0.21.4; from 0.22.0 before 0.22.2; 0.18.0, 0.20.0 — fixed in 0.17.4, 0.19.2, 0.21.4, 0.22.2

How to fix

Upgrade to a fixed version: pomerium 0.17.4, 0.19.2, 0.21.4, 0.22.2. Check the vendor advisory for mitigations.

References

https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
https://github.com/pomerium/pomerium/releases/tag/v0.17.4
https://github.com/pomerium/pomerium/releases/tag/v0.18.1
https://github.com/pomerium/pomerium/releases/tag/v0.19.2
https://github.com/pomerium/pomerium/releases/tag/v0.20.1
https://github.com/pomerium/pomerium/releases/tag/v0.21.4
https://github.com/pomerium/pomerium/releases/tag/v0.22.2
https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p
https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb
https://github.com/pomerium/pomerium/releases/tag/v0.17.4
https://github.com/pomerium/pomerium/releases/tag/v0.18.1
https://github.com/pomerium/pomerium/releases/tag/v0.19.2

Get alerted when CVE-2023-33189 or the next vulnerability affects your stack