8.5
High
CVE-2026-49332 A flaw was found in openshift/oauth-proxy
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.21 1785851359 | earliest → < 1785851359 | 1785851359 |
| Red Hat OpenShift Container Platform 4.20 1785833742 | earliest → < 1785833742 | 1785833742 |
| Red Hat OpenShift Container Platform 4.22 1785885351 | earliest → < 1785885351 | 1785885351 |
| Red Hat OpenShift Container Platform 4.18 1785529735 | earliest → < 1785529735 | 1785529735 |
| Red Hat OpenShift Container Platform 4.19 1785521728 | earliest → < 1785521728 | 1785521728 |
| Red Hat OpenShift Container Platform 4.14 1785549818 | earliest → < 1785549818 | 1785549818 |
| Red Hat OpenShift Container Platform 4.16 1785544039 | earliest → < 1785544039 | 1785544039 |
| Red Hat OpenShift Container Platform 4.2 1785833742 | earliest → < 1785833742 | 1785833742 |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 1786458704 | earliest → < 1786458704 | 1786458704 |
| Red Hat OpenShift Container Platform 4.13 1786477436 | earliest → < 1786477436 | 1786477436 |
| Red Hat OpenShift Container Platform 4.15 1787054100 | earliest → < 1787054100 | 1787054100 |
| Red Hat OpenShift Container Platform 4.17 1787543313 | earliest → < 1787543313 | 1787543313 |
References
- RHSA-2026:50681 access.redhat.com
- RHSA-2026:50758 access.redhat.com
- RHSA-2026:51007 access.redhat.com
- RHSA-2026:51013 access.redhat.com
- RHSA-2026:51022 access.redhat.com
- RHSA-2026:51025 access.redhat.com
- RHSA-2026:51038 access.redhat.com
- RHSA-2026:54188 access.redhat.com
- RHSA-2026:54206 access.redhat.com
- RHSA-2026:56912 access.redhat.com
- RHSA-2026:60023 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2483253 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat OpenShift Container Platform 4
The 629 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
High
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Medium
CVE-2026-120830
Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
7.4
High
CVE-2026-120194
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
7.5
High