CVE-2026-49331: OpenShift OAuth Proxy Auth Bypass Flaw

CVE-2026-49331 Overview

CVE-2026-49331 is an identity header injection vulnerability in openshift/oauth-proxy. The proxy forwards client-supplied identity headers to upstream applications on paths configured with skip-auth-regex. These bypass paths do not strip incoming X-Forwarded-User, X-Forwarded-Email, or X-Forwarded-Access-Token headers. An unauthenticated attacker can forge identity headers on whitelisted paths and impersonate arbitrary users to the upstream application. The flaw is tracked under [CWE-345] Insufficient Verification of Data Authenticity.

Critical Impact
Unauthenticated attackers can spoof authenticated user identities to backend applications by injecting forged headers on paths matching skip-auth-regex.

Affected Products

openshift/oauth-proxy
OpenShift deployments using skip-auth-regex bypass rules
Applications trusting upstream identity headers from oauth-proxy

Discovery Timeline

2026-08-05 - CVE CVE-2026-49331 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-49331

Vulnerability Analysis

The openshift/oauth-proxy component sits in front of upstream applications and enforces OAuth authentication. Operators configure skip-auth-regex to allow anonymous access to specific paths such as health endpoints or public assets. On these bypass paths, the proxy does not process authentication but still passes the incoming request headers through to the upstream application. The proxy fails to strip the identity headers it normally sets after successful authentication. An attacker sends a request to a whitelisted path with forged X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Access-Token headers. The upstream application, which trusts these headers as authoritative, treats the request as coming from the attacker-supplied identity.

Root Cause

The root cause is missing header sanitization on the bypass code path. Authenticated code paths overwrite identity headers with values derived from the validated session. Bypass paths skip both authentication and the header rewrite, allowing client-controlled values to reach the upstream.

Attack Vector

Exploitation requires network access to any path matched by a skip-auth-regex rule. The attacker crafts an HTTP request to that path and sets the identity headers directly. No credentials, prior authentication, or user interaction are required. Impact depends on how the upstream application uses these headers; applications performing authorization, audit logging, or user-scoped data access based on them are directly affected.

Refer to the Red Hat CVE Security Notice and Red Hat Bug Report #2483252 for vendor technical details.

Detection Methods for CVE-2026-49331

Indicators of Compromise

Requests to paths matching skip-auth-regex that contain X-Forwarded-User, X-Forwarded-Email, or X-Forwarded-Access-Token headers set by the client.
Upstream application audit logs showing authenticated actions on endpoints that should be anonymous.
Mismatches between oauth-proxy access logs and upstream application user attribution for the same request.

Detection Strategies

Inspect ingress and proxy logs for inbound identity headers on requests that reach bypass routes.
Compare identity attribution between the proxy layer and the upstream application to surface discrepancies.
Alert on any request containing X-Forwarded-Access-Token originating from outside the trusted proxy chain.

Monitoring Recommendations

Enable request header logging on the proxy for all skip-auth-regex matches.
Forward oauth-proxy and upstream application logs to a central analytics platform for correlation.
Baseline normal traffic on bypass paths and alert on anomalous header presence or user values.

How to Mitigate CVE-2026-49331

Immediate Actions Required

Audit all skip-auth-regex entries and remove any that expose paths where the upstream trusts identity headers.
Configure the upstream application to reject or ignore identity headers on bypass paths.
Strip X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Access-Token at the ingress layer before requests reach oauth-proxy.

Patch Information

Monitor the Red Hat CVE Security Notice for the fixed release of openshift/oauth-proxy. Apply the patched version once available and restart proxy instances across the cluster.

Workarounds

Remove non-essential skip-auth-regex rules until a patched build is deployed.
Insert an ingress rule or sidecar that unconditionally deletes client-supplied identity headers before requests reach oauth-proxy.
Reconfigure upstream applications to derive identity only from validated tokens rather than proxy-supplied headers.

bash

# Example: strip identity headers at ingress before oauth-proxy
# NGINX Ingress annotation
nginx.ingress.kubernetes.io/configuration-snippet: |
  proxy_set_header X-Forwarded-User "";
  proxy_set_header X-Forwarded-Email "";
  proxy_set_header X-Forwarded-Access-Token "";