Skip to content
Fencer Vulns
high 8.5

CVE-2026-49332 json

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

published 2026-07-28 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-49767

cvss
8.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits
0
none known

Summary

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 1786458704
  • Red Hat Red Hat OpenShift Container Platform 4.13 1786477436
  • Red Hat Red Hat OpenShift Container Platform 4.14 1785549818
  • Red Hat Red Hat OpenShift Container Platform 4.15 1787054100
  • Red Hat Red Hat OpenShift Container Platform 4.16 1785544039
  • Red Hat Red Hat OpenShift Container Platform 4.17 1787543313
  • Red Hat Red Hat OpenShift Container Platform 4.18 1785529735
  • Red Hat Red Hat OpenShift Container Platform 4.19 1785521728
  • Red Hat Red Hat OpenShift Container Platform 4.20 1785833742
  • Red Hat Red Hat OpenShift Container Platform 4.21 1785851359
  • Red Hat Red Hat OpenShift Container Platform 4.22 1785885351

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-49332 updated cvss 8.5

openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on WSGI/PHP upstreams

  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-oauth-proxy 1786458704
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:54206
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-oauth-proxy 1786477436
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:54188
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-oauth-proxy 1785549818
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:50681
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-oauth-proxy-rhel9 1787054100
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:56912
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-oauth-proxy-rhel9 1785544039
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:50758
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-oauth-proxy-rhel9 1787543313
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:60023
  • Red Hat OpenShift Container Platform 4.18 openshift4/ose-oauth-proxy-rhel9 1785529735
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:51013
  • Red Hat OpenShift Container Platform 4.19 openshift4/ose-oauth-proxy-rhel9 1785521728
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:51007
show 4 more
  • Red Hat OpenShift Container Platform 4.20 openshift4/ose-oauth-proxy-rhel9 1785833742
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:51022
  • Red Hat OpenShift Container Platform 4.21 openshift4/ose-oauth-proxy-rhel9 1785851359
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:51025
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-oauth-proxy-rhel9 1785885351
    fixed: vendor fix “Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.” RHSA-2026:51038
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-cli 1786458728, openshift4/ose-pod 1786458850, openshift4/ose-etcd 1786458674, openshift4/ose-tests 1786461085, openshift4/ose-console 1786511587, openshift4/ose-coredns 1786458726, +183 more Red Hat OpenShift Container Platform 4.13 openshift4/ose-cli 1786477847, openshift4/ose-pod 1786477900, openshift4/ose-tests 1786480143, openshift4/ose-console 1786477760, openshift4/ose-coredns 1786477624, openshift4/ose-deployer 1786479204, +184 more Red Hat OpenShift Container Platform 4.14 openshift4/ose-cli 1785732395, openshift4/ose-pod 1785734027, openshift4/ose-tests 1785821800, openshift4/ose-console 1785845099, openshift4/ose-coredns 1785733219, openshift4/ose-deployer 1785734095, +191 more Red Hat OpenShift Container Platform 4.15 openshift4/ose-cli 1787028201, openshift4/ose-tests 1787031287, openshift4/ose-console 1787028559, openshift4/ose-deployer 1787030550, openshift4/ose-installer 1787037007, openshift4/ose-pod-rhel9 1787056429, +186 more Red Hat OpenShift Container Platform 4.16 openshift4/ose-cli-rhel9 1785530229, openshift4/ose-pod-rhel9 1785542889, openshift4/ose-sdn-rhel9 1785542496, openshift4/ose-etcd-rhel9 1785582736, openshift4/ose-tools-rhel9 1785540957, openshift4/ose-ironic-rhel9 1785528575, +183 more Red Hat OpenShift Container Platform 4.17 openshift4/frr-rhel9 1787543472, openshift4/ose-cli-rhel9 1787549445, openshift4/ose-pod-rhel9 1787548386, openshift4/ose-etcd-rhel9 1787551063, openshift4/ose-tests-rhel9 1787549986, openshift4/ose-tools-rhel9 1787547280, +182 more
    +5 more products
    Red Hat OpenShift Container Platform 4.18 openshift4/frr-rhel9 1785523493, openshift4/ose-cli-rhel9 1785524167, openshift4/ose-pod-rhel9 1785530791, openshift4/ose-etcd-rhel9 1785527466, openshift4/ose-tests-rhel9 1785526261, openshift4/ose-tools-rhel9 1785523577, +182 more Red Hat OpenShift Container Platform 4.19 openshift4/frr-rhel9 1785521051, openshift4/ose-cli-rhel9 1785520973, openshift4/ose-pod-rhel9 1785525255, openshift4/ose-etcd-rhel9 1785525105, openshift4/ose-tests-rhel9 1785534871, openshift4/ose-tools-rhel9 1785519805, +182 more Red Hat OpenShift Container Platform 4.20 openshift4/frr-rhel9 1785832631, openshift4/ose-cli-rhel9 1785832608, openshift4/ose-pod-rhel9 1785834062, openshift4/ose-etcd-rhel9 1785836121, openshift4/ose-tests-rhel9 1785856627, openshift4/ose-tools-rhel9 1785833138, +184 more Red Hat OpenShift Container Platform 4.21 openshift4/frr-rhel9 1785850506, openshift4/ose-cli-rhel9 1785933306, openshift4/ose-pod-rhel9 1785850871, openshift4/ose-etcd-rhel9 1785869523, openshift4/ose-tests-rhel9 1785935766, openshift4/ose-tools-rhel9 1785933686, +181 more Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1785883609, openshift4/ose-cli-rhel9 1785883865, openshift4/ose-pod-rhel9 1785885460, openshift4/ose-etcd-rhel9 1785884715, openshift4/ose-tests-rhel9 1785886018, openshift4/ose-tools-rhel9 1785883357, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat Red Hat OpenShift Container Platform 4.20
  • Red Hat Red Hat OpenShift Container Platform 4.21
  • Red Hat Red Hat OpenShift Container Platform 4.22

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.