← CVE Intelligence

CVE-2026-46579

Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend PUBLISHED

Description (CNA)

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1784323891 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1784056734 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1784587649 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1784580646 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 1784331638 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 1784321465 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 1783719377 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 1783445642 before *
Red Hat / Red Hat OpenShift Container Platform 4.20unaffected 1781639027 before *
Red Hat / Red Hat OpenShift Container Platform 4.21unaffected 1781552170 before *
Red Hat / Red Hat OpenShift Container Platform 4.22unaffected 1781643967 before *

CWE

CWE-287

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.