← CVE Intelligence

CVE-2026-49332

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams PUBLISHED

Description (CNA)

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat OpenShift Container Platform 4.12unaffected 1786458704 before *
Red Hat / Red Hat OpenShift Container Platform 4.13unaffected 1786477436 before *
Red Hat / Red Hat OpenShift Container Platform 4.14unaffected 1785549818 before *
Red Hat / Red Hat OpenShift Container Platform 4.15unaffected 1787054100 before *
Red Hat / Red Hat OpenShift Container Platform 4.16unaffected 1785544039 before *
Red Hat / Red Hat OpenShift Container Platform 4.17unaffected 1787543313 before *
Red Hat / Red Hat OpenShift Container Platform 4.18unaffected 1785529735 before *
Red Hat / Red Hat OpenShift Container Platform 4.19unaffected 1785521728 before *
Red Hat / Red Hat OpenShift Container Platform 4.20unaffected 1785833742 before *
Red Hat / Red Hat OpenShift Container Platform 4.21unaffected 1785851359 before *
Red Hat / Red Hat OpenShift Container Platform 4.22unaffected 1785885351 before *

CWE

CWE-436

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.