CVE-2026-33495: Authentication Bypass in Ory Oathkeeper
Platform
go
Component
github.com/ory/oathkeeper
Fixed in
0.40.10-0.20260320084810-e9acca14a04d
CVE-2026-33495 describes an Authentication Bypass vulnerability in Ory Oathkeeper, a component often used for authentication and authorization. This vulnerability arises when Oathkeeper trusts X-Forwarded-Proto headers, allowing attackers to potentially bypass authentication rules if the proxy configuration is not secure. Versions prior to 0.40.10-0.20260320084810-e9acca14a04d are affected, and a patch is available.
Detect this CVE in your project
Upload your go.mod file and we'll tell you instantly if you're affected.
Impact and Attack Scenarios
An attacker exploiting this vulnerability could bypass authentication checks within Ory Oathkeeper. This is particularly concerning when Oathkeeper is deployed behind reverse proxies or CDNs. By manipulating the X-Forwarded-Proto header, an attacker could trick Oathkeeper into thinking a request is using HTTPS when it's actually HTTP, or vice versa. This could lead to unauthorized access to protected resources or services that rely on Oathkeeper for authentication. The impact is amplified if Oathkeeper is a central authentication point for multiple applications, as a successful exploit could compromise a wider range of systems.
Exploitation Context
CVE-2026-33495 was published on 2026-03-20. The vulnerability's severity is Medium. No public exploits or active campaigns have been reported at the time of writing. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Review the official Ory Oathkeeper advisory for further details.
Threat Intelligence
Exploit Status
EPSS
0.03% (10% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Unchanged — impact is limited to the vulnerable component itself.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation is to upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. If upgrading is not immediately feasible, consider temporarily disabling the serve.proxy.trustforwardedheaders configuration option. This will prevent Oathkeeper from trusting any X-Forwarded-* headers, effectively disabling the vulnerable functionality. Ensure your reverse proxy or CDN is properly configured to only forward trusted headers and that the protocol matches the original request. Monitor Oathkeeper logs for suspicious activity related to header manipulation.
How to fix
Actualice Ory Oathkeeper a la versión 26.2.0 o superior. Como mitigación adicional, se recomienda eliminar cualquier encabezado inesperado lo antes posible al manejar una solicitud, por ejemplo, en el WAF.
Frequently asked questions
What is CVE-2026-33495 — Authentication Bypass in Ory Oathkeeper?
CVE-2026-33495 is a vulnerability in Ory Oathkeeper allowing attackers to bypass authentication rules by manipulating X-Forwarded-Proto headers. This affects versions before 0.40.10-0.20260320084810-e9acca14a04d, potentially leading to unauthorized access.
Am I affected by CVE-2026-33495 in Ory Oathkeeper?
You are affected if you are running Ory Oathkeeper versions prior to 0.40.10-0.20260320084810-e9acca14a04d and are using the serve.proxy.trustforwardedheaders option. Check your version and configuration immediately.
How do I fix CVE-2026-33495 in Ory Oathkeeper?
Upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. As a temporary workaround, disable the serve.proxy.trustforwardedheaders configuration option.
Is CVE-2026-33495 being actively exploited?
As of the current assessment, CVE-2026-33495 is not known to be actively exploited. However, it's crucial to apply the patch or workaround to prevent potential future exploitation.
Where can I find the official Ory Oathkeeper advisory for CVE-2026-33495?
Refer to the official Ory Oathkeeper security advisory for detailed information and updates regarding CVE-2026-33495: [https://www.ory.sh/security](https://www.ory.sh/security)
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your go.mod file and we'll tell you instantly if you're affected.
Scan your Go project now — no account
Upload your go.mod and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...