PT-2026-26779 · Ory · Ory Oathkeeper

Zepatrik · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33495

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ory Oathkeeper (affected versions not specified)

Description Ory Oathkeeper, when deployed behind components like CDNs or reverse proxies, may incorrectly evaluate rules due to improper handling of the X-Forwarded-Proto header. The configuration option serve.proxy.trust forwarded headers was not properly respected, leading Oathkeeper to always consider this header, even when it should not. This could allow an attacker to trigger different rules by manipulating the X-Forwarded-Proto header, provided distinct rules exist for HTTP and HTTPS requests and the attacker can trigger one but not the other.

Recommendations Upgrade to a fixed version of Ory Oathkeeper. It is generally recommended to drop any unexpected headers as early as possible when a request is handled, for example, in a WAF.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33495

GHSA-VHR5-GGP3-QQ85

GO-2026-4810

SUSE-SU-2026:1135-1

Affected Products

Ory Oathkeeper

References · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33495.json · Exploit
• https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85 · Vendor Advisory
• https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33495 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33495 · Security Note
• https://osv.dev/vulnerability/GHSA-vhr5-ggp3-qq85 · Vendor Advisory
• https://github.com/ory/oathkeeper · Note
• https://suse.com/security/cve/CVE-2026-32760 · Note
• https://suse.com/security/cve/CVE-2026-29785 · Note
• https://suse.com/security/cve/CVE-2026-33758 · Note
• https://suse.com/security/cve/CVE-2026-33223 · Note
• https://suse.com/security/cve/CVE-2026-33623 · Note
• https://suse.com/security/cve/CVE-2026-33668 · Note