CVE-2026-49331 Red Hat CVE debrief

Who should care

Administrators and users of openshift/oauth-proxy, especially those with whitelisted paths configured, should be aware of the potential security risks and take necessary actions to mitigate them. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

A flaw in openshift/oauth-proxy allows unauthenticated attackers to inject forged identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) on paths configured to bypass authentication (skip-auth-regex). The proxy forwards client-supplied identity headers to the upstream application without stripping them, potentially leading to identity header injection. This vulnerability can be mitigated by verifying and updating openshift/oauth-proxy to the latest version, reviewing and restricting the use of identity headers in whitelisted paths, and implementing additional authentication and authorization checks for whitelisted paths.

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for identity header injection.

Recommended defensive actions

• Verify and update openshift/oauth-proxy to the latest version
• Review and restrict the use of identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) in whitelisted paths
• Implement additional authentication and authorization checks for whitelisted paths
• Monitor for suspicious activity and anomalies in identity header usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; primary official records indicate a flaw in openshift/oauth-proxy allowing unauthenticated attackers to inject forged identity headers on whitelisted paths. The CVE record was published on 2026-08-05T16:16:57.330Z and has not been modified since then. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources