CVE-2026-33494: Path Traversal in Ory Oathkeeper

The path traversal vulnerability in Ory Oathkeeper allows an attacker to bypass authorization checks and access protected resources. By manipulating the URL to include sequences like /public/../admin/secrets, an attacker can effectively navigate the file system beyond the intended boundaries. This can lead to unauthorized access to sensitive configuration files, credentials, or other data that should be protected by Oathkeeper's rules. The potential impact is significant, as a successful exploit could compromise the entire authentication infrastructure and expose user data. This vulnerability shares similarities with other path traversal exploits where improper input validation allows attackers to access files outside of the intended scope.

1. Reserved2026-03-20
2. Published2026-03-20
3. Modified2026-03-27
4. EPSS updated2026-04-03

The primary mitigation for CVE-2026-33494 is to upgrade to version 0.40.10-0.20260320084758-8e0002140491 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds. Review Oathkeeper's rule configuration to ensure proper path normalization is enforced. While a direct WAF rule is difficult to implement due to the nature of path traversal, consider implementing stricter input validation on incoming requests to filter out suspicious characters and sequences. Monitor Oathkeeper logs for unusual access patterns or attempts to access restricted resources. After upgrading, confirm the fix by attempting to access protected resources using crafted URLs containing path traversal sequences; access should be denied.