PT-2026-26780 · Ory · Ory Oathkeeper

Patrik · Published 2026-03-20 · Updated 2026-03-27 · CVE-2026-33496

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ory Oathkeeper (affected versions not specified)

Description Ory Oathkeeper is susceptible to authentication bypass due to cache key confusion within the oauth2 introspection authenticator. The caching mechanism does not differentiate between tokens validated using distinct introspection URLs. An attacker can leverage a valid token to populate the cache and subsequently utilize the same token for rules associated with a different introspection server. This requires multiple oauth2 introspection authenticator servers configured with caching enabled, and the attacker must possess a valid token for one of these servers.

Recommendations Update to the patched version of Ory Oathkeeper. If an immediate update is not feasible, disable caching for oauth2 introspection authenticators.

Exploit

Fix

Weakness Enumeration

CWE-1289

CWE-305

Related Identifiers

CVE-2026-33496

GHSA-4MQ7-PVJG-XP2R

GO-2026-4799

SUSE-SU-2026:1135-1

Affected Products

Ory Oathkeeper

References · 150

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33496.json · Exploit
• https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c · Patch
• https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33496 · Security Note
• https://osv.dev/vulnerability/GHSA-4mq7-pvjg-xp2r · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4799 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33496 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/ory/oathkeeper · Note
• https://suse.com/security/cve/CVE-2026-33481 · Note
• https://suse.com/security/cve/CVE-2026-33203 · Note
• https://suse.com/security/cve/CVE-2026-26246 · Note
• https://suse.com/security/cve/CVE-2026-27889 · Note
• https://suse.com/security/cve/CVE-2026-32285 · Note
• https://suse.com/security/cve/CVE-2026-33529 · Note