CVE-2026-46579: OpenShift Router Auth Bypass Vulnerability

CVE-2026-46579 Overview

CVE-2026-46579 is an authentication bypass vulnerability in the OpenShift Router. When a Route is configured with insecureEdgeTerminationPolicy set to Allow, the HTTP frontend fails to strip X-SSL-Client-* headers from incoming requests. Unauthenticated attackers can send plain HTTP requests with forged X-SSL-Client-* headers to backends that rely on these headers for mutual TLS (mTLS) authentication. This permits impersonation of arbitrary client certificate identities without ever presenting a certificate. The flaw is categorized under [CWE-287] Improper Authentication.

Critical Impact
Attackers can bypass mTLS authentication and impersonate any client certificate identity by sending crafted plain HTTP requests through the OpenShift Router.

Affected Products

Red Hat OpenShift Router (HAProxy-based ingress component)
OpenShift Container Platform deployments using Routes with insecureEdgeTerminationPolicy: Allow
Backend services relying on X-SSL-Client-* headers for mTLS-based identity

Discovery Timeline

2026-05-29 - CVE-2026-46579 published to the National Vulnerability Database
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-46579

Vulnerability Analysis

The OpenShift Router terminates TLS at the edge and forwards client certificate metadata to backend pods using headers such as X-SSL-Client-Subject, X-SSL-Client-DN, and X-SSL-Client-Cert. Backend applications typically trust these headers to identify the authenticated client. The router is expected to overwrite or remove any client-supplied values to prevent header smuggling.

When insecureEdgeTerminationPolicy is set to Allow, the router accepts plain HTTP traffic on the same Route. In this code path, the HTTP frontend does not sanitize the X-SSL-Client-* header family. Headers supplied by the attacker pass through unchanged to backend workloads, which treat them as router-generated and therefore authoritative.

Root Cause

The root cause is missing header sanitization on the HTTP listener for Routes that permit both encrypted and plain traffic. The HTTPS listener correctly injects validated values from the negotiated TLS session, but the HTTP listener lacks the equivalent http-request del-header logic for X-SSL-Client-* prefixed headers.

Attack Vector

An unauthenticated network attacker sends an HTTP request to a vulnerable Route and includes headers such as X-SSL-Client-DN: CN=admin,O=internal and X-SSL-Client-Verify: SUCCESS. The router forwards the request to the backend, which parses the headers and authenticates the attacker as the impersonated identity. Exploitation requires only network reachability to the Route and knowledge of an identity value the backend trusts.

No verified public exploit code is available for CVE-2026-46579. Refer to the Red Hat CVE-2026-46579 Advisory and Red Hat Bug Report #2483181 for vendor technical detail.

Detection Methods for CVE-2026-46579

Indicators of Compromise

Inbound HTTP requests containing X-SSL-Client-* headers arriving on Routes configured with insecureEdgeTerminationPolicy: Allow.
Backend access logs showing authenticated sessions from client identities that did not complete TLS client certificate negotiation at the edge.
Discrepancies between router TLS session logs and backend-reported client subject DNs.

Detection Strategies

Audit OpenShift Route definitions for spec.tls.insecureEdgeTerminationPolicy: Allow and correlate with backends that consume X-SSL-Client-* headers.
Enable HAProxy request logging on the router and alert on any client-supplied X-SSL-Client-* headers on HTTP listeners.
Compare authentication events in backend application logs against the router TLS handshake telemetry to detect identity mismatches.

Monitoring Recommendations

Forward router and application logs to a centralized analytics platform and create detections for X-SSL-Client-* headers on non-TLS request paths.
Track changes to Route resources via Kubernetes audit logs, flagging any switch to insecureEdgeTerminationPolicy: Allow.
Monitor authentication anomalies such as privileged identities appearing from source IPs that have never completed a mTLS handshake.

How to Mitigate CVE-2026-46579

Immediate Actions Required

Inventory all Routes with insecureEdgeTerminationPolicy: Allow and change them to Redirect or None unless plain HTTP is strictly required.
Apply the security update referenced in the Red Hat CVE-2026-46579 Advisory once available for your OpenShift channel.
Configure backend services to reject X-SSL-Client-* headers received over connections not authenticated by the router via a trusted internal channel.

Patch Information

Red Hat tracks remediation under Red Hat Bug Report #2483181. Consult the Red Hat advisory for the fixed OpenShift Router image digests and errata applicable to your supported OpenShift version.

Workarounds

Set insecureEdgeTerminationPolicy to Redirect so all client traffic is forced over TLS before reaching the backend.
Add an explicit HAProxy configuration snippet via a router environment override to delete X-SSL-Client-* headers on the HTTP frontend.
Enforce mTLS validation at the backend rather than trusting header-based identity claims from the edge.

bash

# Disable plain HTTP exposure on an affected Route
oc patch route <route-name> -n <namespace> --type=merge \
  -p '{"spec":{"tls":{"insecureEdgeTerminationPolicy":"Redirect"}}}'

# Verify no Routes remain with the vulnerable policy
oc get route -A -o json | \
  jq '.items[] | select(.spec.tls.insecureEdgeTerminationPolicy=="Allow") | {ns:.metadata.namespace,name:.metadata.name}'