Identity Header Manipulation in OpenShift OAuth Proxy by Red Hat
CVE-2026-49332

8.5HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Openshift Container Platform 4.12
Red Hat Openshift Container Platform 4.13
Red Hat Openshift Container Platform 4.14
Red Hat Openshift Container Platform 4.15
Vendor
CVE Published:
28 July 2026

What is CVE-2026-49332?

A flaw in OpenShift OAuth Proxy allows attackers to manipulate identity headers. The proxy utilizes only dash-variant keys (X-Forwarded-User) when setting authenticated identity headers, neglecting to strip underscore-variant keys (X_Forwarded_User) from incoming requests. This oversight lets an authenticated low-privilege user potentially smuggle a false identity, which could override legitimate identities in the upstream application, leading to unauthorized access and privilege escalation.

Affected Version(s)

Red Hat OpenShift Container Platform 4.12 1786458704

Red Hat OpenShift Container Platform 4.13 1786477436

Red Hat OpenShift Container Platform 4.14 1785549818

References

https://access.redhat.com/errata/RHSA-2026:50681
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50758
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:51007
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Jeremy Choi (Red Hat).
.