What’s Vulnerable › Vulnerabilities
CVE-2026-49332: Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams
- Severity: high (CVSS 8.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-07-28 · updated 2026-10-24
- Weakness: CWE-436
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Affected products
- Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1785529735
- Red Hat OpenShift Container Platform 4.12: all versions — fixed in 1786458704
- Red Hat OpenShift Container Platform 4.13: all versions — fixed in 1786477436
- Red Hat OpenShift Container Platform 4.14: all versions — fixed in 1785549818
- Red Hat OpenShift Container Platform 4.15: all versions — fixed in 1787054100
- Red Hat OpenShift Container Platform 4.16: all versions — fixed in 1785544039
- Red Hat OpenShift Container Platform 4.17: all versions — fixed in 1787543313
- Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1785521728
- Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1785833742
- Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1785851359
- Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1785885351
How to fix
Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1785529735; Red Hat OpenShift Container Platform 4.12 1786458704; Red Hat OpenShift Container Platform 4.13 1786477436; Red Hat OpenShift Container Platform 4.14 1785549818; Red Hat OpenShift Container Platform 4.15 1787054100; Red Hat OpenShift Container Platform 4.16 1785544039; Red Hat OpenShift Container Platform 4.17 1787543313; Red Hat OpenShift Container Platform 4.19 1785521728; Red Hat OpenShift Container Platform 4.20 1785833742; Red Hat OpenShift Container Platform 4.21 1785851359; Red Hat OpenShift Container Platform 4.22 1785885351. Check the vendor advisory for mitigations.
References
- https://access.redhat.com/errata/RHSA-2026:50681
- https://access.redhat.com/errata/RHSA-2026:50758
- https://access.redhat.com/errata/RHSA-2026:51007
- https://access.redhat.com/errata/RHSA-2026:51013
- https://access.redhat.com/errata/RHSA-2026:51022
- https://access.redhat.com/errata/RHSA-2026:51025
- https://access.redhat.com/errata/RHSA-2026:51038
- https://access.redhat.com/errata/RHSA-2026:54188
- https://access.redhat.com/errata/RHSA-2026:54206
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/security/cve/CVE-2026-49332
Get alerted when CVE-2026-49332 or the next vulnerability affects your stack