CVE-2026-49332: OpenShift OAuth Proxy Auth Bypass Flaw

CVE-2026-49332 Overview

CVE-2026-49332 is an identity header smuggling flaw in openshift/oauth-proxy. The proxy sets authenticated identity headers using dash-variant keys such as X-Forwarded-User but does not strip underscore-variant keys such as X_Forwarded_User from incoming requests. Web Server Gateway Interface (WSGI) and PHP frameworks normalize both variants to the same environment variable. An authenticated low-privilege user can inject a forged identity header that overrides the legitimate authenticated identity in the upstream application. The weakness is classified as [CWE-436] Interpretation Conflict.

Critical Impact
A low-privilege authenticated user can impersonate other identities in upstream applications that rely on the proxy for authentication decisions.

Affected Products

openshift/oauth-proxy
Red Hat OpenShift deployments using the affected proxy component
Upstream applications built on WSGI or PHP frameworks behind openshift/oauth-proxy

Discovery Timeline

2026-07-28 - CVE-2026-49332 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-49332

Vulnerability Analysis

The vulnerability arises from inconsistent handling of HTTP header name variants between openshift/oauth-proxy and common upstream frameworks. The proxy authenticates the user and sets identity headers using the canonical dash form, such as X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Groups. It does not remove or overwrite the underscore variants of these headers that clients may send.

WSGI and PHP normalize incoming headers into environment variables by uppercasing the name and converting dashes to underscores. Both X-Forwarded-User and X_Forwarded_User collapse into the same variable, HTTP_X_FORWARDED_USER. When two variants arrive together, framework behavior determines which value wins, and attacker-supplied values can override the proxy-set identity.

Root Cause

The root cause is an interpretation conflict between HTTP header parsers. The proxy treats dash and underscore forms as distinct headers, while downstream frameworks treat them as equivalent. Because the proxy trusts its own dash-form headers and never sanitizes underscore-form headers from the client, an inconsistency emerges that violates the trust boundary the proxy is meant to enforce.

Attack Vector

An authenticated low-privilege user sends a request through openshift/oauth-proxy containing an underscore-variant identity header, for example X_Forwarded_User: admin. The proxy passes the header through unchanged and appends its own dash-variant header for the real user. The WSGI or PHP upstream normalizes both keys to HTTP_X_FORWARDED_USER and, depending on framework precedence, may present the forged identity to application logic. Applications that authorize actions based on the forwarded identity treat the request as coming from the impersonated account.

No verified public exploit code is available. See the Red Hat CVE-2026-49332 Advisory and Red Hat Bug Report #2483253 for vendor technical details.

Detection Methods for CVE-2026-49332

Indicators of Compromise

Inbound HTTP requests containing underscore-variant identity headers such as X_Forwarded_User, X_Forwarded_Email, X_Forwarded_Groups, or X_Forwarded_Preferred_Username
Upstream application audit logs showing actions attributed to users who did not authenticate through openshift/oauth-proxy
Mismatches between proxy access logs and upstream application identity logs for the same request ID

Detection Strategies

Inspect raw HTTP header bytes at the proxy or ingress layer for underscore characters in identity-related header names
Correlate openshift/oauth-proxy authentication events with upstream application identity claims to identify divergence
Alert on any request where both dash and underscore variants of an identity header are present simultaneously

Monitoring Recommendations

Enable verbose header logging on ingress controllers in front of openshift/oauth-proxy for identity header fields
Forward proxy and application logs to a centralized analytics platform for cross-layer identity correlation
Baseline expected header names for internal services and flag deviations that include underscore variants

How to Mitigate CVE-2026-49332

Immediate Actions Required

Upgrade openshift/oauth-proxy to a fixed release once published by Red Hat, tracked in the Red Hat CVE-2026-49332 Advisory
Configure ingress or a front-end reverse proxy to strip all underscore-variant identity headers before requests reach openshift/oauth-proxy
Audit upstream WSGI and PHP applications for authorization decisions that trust forwarded identity headers

Patch Information

Refer to the Red Hat CVE-2026-49332 Advisory and Red Hat Bug Report #2483253 for fixed component versions and errata. Apply vendor updates through the standard OpenShift patching workflow.

Workarounds

Drop or rename any header containing underscores in identity-related names at the ingress layer using NGINX, HAProxy, or Envoy filters
Configure WSGI and PHP frameworks to reject or ignore underscore-form headers where possible
Require upstream applications to validate identity via a signed token, such as a JSON Web Token (JWT), rather than plain forwarded headers

bash

# NGINX ingress example: strip underscore-variant identity headers before oauth-proxy
underscores_in_headers off;
ignore_invalid_headers on;

proxy_set_header X_Forwarded_User "";
proxy_set_header X_Forwarded_Email "";
proxy_set_header X_Forwarded_Groups "";
proxy_set_header X_Forwarded_Preferred_Username "";