Security Advisory catalog CVE-2026-49332
cve-program · CVE-2026-49332 Published
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-49332 Published openshift4/ose-oauth-proxy https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.12",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy",
"defaultStatus": "affected",
"versions": [
{
"version": "1786458704",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.12::el9"
]
} openshift4/ose-oauth-proxy https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.13",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy",
"defaultStatus": "affected",
"versions": [
{
"version": "1786477436",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.13::el9"
]
} openshift4/ose-oauth-proxy https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.14",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy",
"defaultStatus": "affected",
"versions": [
{
"version": "1785549818",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.14::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.15",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1787054100",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.15::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.16",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785544039",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.16::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.17",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1787543313",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.17::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.18",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785529735",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.18::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.19",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785521728",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.19::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.20",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785833742",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.20::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.21",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785851359",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.21::el9"
]
} openshift4/ose-oauth-proxy-rhel9 https://catalog.redhat.com/software/containers/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4.22",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "openshift4/ose-oauth-proxy-rhel9",
"defaultStatus": "affected",
"versions": [
{
"version": "1785885351",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:openshift:4.22::el9"
]
} Original source record · Cite this exact observation · Complete original publisher JSON