PT-2026-26780 · Ory · Ory Oathkeeper

Patrik · Publicado 2026-03-20 · Atualizado 2026-03-27 · CVE-2026-33496

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ory Oathkeeper (affected versions not specified)

Description Ory Oathkeeper is susceptible to authentication bypass due to cache key confusion within the oauth2 introspection authenticator. The caching mechanism does not differentiate between tokens validated using distinct introspection URLs. An attacker can leverage a valid token to populate the cache and subsequently utilize the same token for rules associated with a different introspection server. This requires multiple oauth2 introspection authenticator servers configured with caching enabled, and the attacker must possess a valid token for one of these servers.

Recommendations Update to the patched version of Ory Oathkeeper. If an immediate update is not feasible, disable caching for oauth2 introspection authenticators.

Exploit

Correção

Enumeração de Fraquezas

CWE-1289

CWE-305

Identificadores relacionados

CVE-2026-33496

GHSA-4MQ7-PVJG-XP2R

GO-2026-4799

SUSE-SU-2026:1135-1

Produtos afetados

Ory Oathkeeper

Referências · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33496.json · Exploit
• https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c · Correção
• https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r · Aviso do Fabricante
• https://github.com/ory/oathkeeper · Nota
• https://suse.com/security/cve/CVE-2026-33481 · Nota
• https://suse.com/security/cve/CVE-2026-33203 · Nota
• https://suse.com/security/cve/CVE-2026-26246 · Nota
• https://suse.com/security/cve/CVE-2026-27889 · Nota
• https://suse.com/security/cve/CVE-2026-32285 · Nota
• https://suse.com/security/cve/CVE-2026-33529 · Nota
• https://suse.com/security/cve/CVE-2026-33669 · Nota
• https://suse.com/security/cve/CVE-2026-4342 · Nota
• https://suse.com/security/cve/CVE-2026-24692 · Nota
• https://suse.com/security/cve/CVE-2026-22545 · Nota
• https://suse.com/security/cve/CVE-2026-32938 · Nota