{"id":"CVE-2026-49332","state":"PUBLISHED","title":"Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams","description":"A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.","publishedAt":"2026-07-28T12:18:26.112Z","updatedAt":"2026-09-21T16:09:11.495Z","severity":{"score":8.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat OpenShift Container Platform 4.12","Red Hat Red Hat OpenShift Container Platform 4.13","Red Hat Red Hat OpenShift Container Platform 4.14","Red Hat Red Hat OpenShift Container Platform 4.15","Red Hat Red Hat OpenShift Container Platform 4.16","Red Hat Red Hat OpenShift Container Platform 4.17","Red Hat Red Hat OpenShift Container Platform 4.18","Red Hat Red Hat OpenShift Container Platform 4.19","Red Hat Red Hat OpenShift Container Platform 4.20","Red Hat Red Hat OpenShift Container Platform 4.21","Red Hat Red Hat OpenShift Container Platform 4.22"],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1786458704","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1786477436","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1785549818","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1787054100","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785544039","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1787543313","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785529735","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785521728","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785833742","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785851359","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785885351","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:50681","https://access.redhat.com/errata/RHSA-2026:50758","https://access.redhat.com/errata/RHSA-2026:51007","https://access.redhat.com/errata/RHSA-2026:51013","https://access.redhat.com/errata/RHSA-2026:51022","https://access.redhat.com/errata/RHSA-2026:51025","https://access.redhat.com/errata/RHSA-2026:51038","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:54206","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/security/cve/CVE-2026-49332","https://bugzilla.redhat.com/show_bug.cgi?id=2483253"],"weaknesses":["CWE-436"],"ingestedAt":"2026-10-29T20:12:07.131Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/49xxx/CVE-2026-49332.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-49332","state":"PUBLISHED","datePublished":"2026-07-28T12:18:26.112Z","dateUpdated":"2026-09-21T16:09:11.495Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-05-29T13:28:56.553Z"},"containers":{"cna":{"title":"Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams","descriptions":[{"lang":"en","value":"A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application."}],"affected":[{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.12","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1786458704","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.13","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1786477436","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.14","packageName":"openshift4/ose-oauth-proxy","defaultStatus":"affected","versions":[{"version":"1785549818","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.15","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1787054100","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.16","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785544039","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.17","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1787543313","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.17::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.18","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785529735","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.18::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.19","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785521728","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.19::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.20","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785833742","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.20::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.21","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785851359","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.21::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4.22","packageName":"openshift4/ose-oauth-proxy-rhel9","defaultStatus":"affected","versions":[{"version":"1785885351","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.22::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:50681","name":"RHSA-2026:50681","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50758","name":"RHSA-2026:50758","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51007","name":"RHSA-2026:51007","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51013","name":"RHSA-2026:51013","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51022","name":"RHSA-2026:51022","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51025","name":"RHSA-2026:51025","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:51038","name":"RHSA-2026:51038","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54188","name":"RHSA-2026:54188","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54206","name":"RHSA-2026:54206","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:56912","name":"RHSA-2026:56912","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60023","name":"RHSA-2026:60023","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-49332","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483253","name":"RHBZ#2483253","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-436","description":"Interpretation Conflict","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-09-21T16:09:11.495Z"},"datePublic":"2026-07-28T12:00:00.000Z","x_redhatCweChain":"CWE-436: Interpretation Conflict","workarounds":[{"lang":"en","value":"Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session."}],"timeline":[{"lang":"en","time":"2026-04-17T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-07-28T12:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Jeremy Choi (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-28T13:02:35.727357Z","id":"CVE-2026-49332","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-28T13:03:08.605Z"}}]}}}