What’s Vulnerable › Vulnerabilities

CVE-2026-83589: Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-01 · updated 2026-10-30
• Weakness: CWE-601

Description

A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions — fixed in 1790882320
• Red Hat OpenShift Container Platform 4.12: all versions — fixed in 1792974337
• Red Hat OpenShift Container Platform 4.14: all versions — fixed in 1791837363
• Red Hat OpenShift Container Platform 4.15: all versions — fixed in 1791632336
• Red Hat OpenShift Container Platform 4.16: all versions — fixed in 1792878232
• Red Hat OpenShift Container Platform 4.19: all versions — fixed in 1790807096
• Red Hat OpenShift Container Platform 4.20: all versions — fixed in 1790704224
• Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1790706478
• Red Hat OpenShift Container Platform 4.22: all versions — fixed in 1790724885

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 1790882320; Red Hat OpenShift Container Platform 4.12 1792974337; Red Hat OpenShift Container Platform 4.14 1791837363; Red Hat OpenShift Container Platform 4.15 1791632336; Red Hat OpenShift Container Platform 4.16 1792878232; Red Hat OpenShift Container Platform 4.19 1790807096; Red Hat OpenShift Container Platform 4.20 1790704224; Red Hat OpenShift Container Platform 4.21 1790706478; Red Hat OpenShift Container Platform 4.22 1790724885. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:74380
• https://access.redhat.com/errata/RHSA-2026:74383
• https://access.redhat.com/errata/RHSA-2026:74429
• https://access.redhat.com/errata/RHSA-2026:79039
• https://access.redhat.com/errata/RHSA-2026:79169
• https://access.redhat.com/errata/RHSA-2026:82785
• https://access.redhat.com/errata/RHSA-2026:82813
• https://access.redhat.com/errata/RHSA-2026:89715
• https://access.redhat.com/errata/RHSA-2026:90274
• https://access.redhat.com/security/cve/CVE-2026-83589
• https://bugzilla.redhat.com/show_bug.cgi?id=2518379

Get alerted when CVE-2026-83589 or the next vulnerability affects your stack