このページはまだあなたの言語に翻訳されていません。翻訳作業中のため、英語でコンテンツを表示しています。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-33495: Authentication Bypass in Ory Oathkeeper
プラットフォーム
go
コンポーネント
github.com/ory/oathkeeper
修正版
0.40.10-0.20260320084810-e9acca14a04d
CVE-2026-33495 describes an Authentication Bypass vulnerability in Ory Oathkeeper, a component often used for authentication and authorization. This vulnerability arises when Oathkeeper trusts X-Forwarded-Proto headers, allowing attackers to potentially bypass authentication rules if the proxy configuration is not secure. Versions prior to 0.40.10-0.20260320084810-e9acca14a04d are affected, and a patch is available.
このCVEがあなたのプロジェクトに影響するか確認
go.mod ファイルをアップロードすると、影響の有無を即座にお知らせします。
影響と攻撃シナリオ翻訳中…
An attacker exploiting this vulnerability could bypass authentication checks within Ory Oathkeeper. This is particularly concerning when Oathkeeper is deployed behind reverse proxies or CDNs. By manipulating the X-Forwarded-Proto header, an attacker could trick Oathkeeper into thinking a request is using HTTPS when it's actually HTTP, or vice versa. This could lead to unauthorized access to protected resources or services that rely on Oathkeeper for authentication. The impact is amplified if Oathkeeper is a central authentication point for multiple applications, as a successful exploit could compromise a wider range of systems.
悪用の状況翻訳中…
CVE-2026-33495 was published on 2026-03-20. The vulnerability's severity is Medium. No public exploits or active campaigns have been reported at the time of writing. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Review the official Ory Oathkeeper advisory for further details.
脅威インテリジェンス
エクスプロイト状況
EPSS
0.03% (10% パーセンタイル)
CISA SSVC
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- なし — 認証不要。資格情報なしで悪用可能。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- 低 — 一部データへの部分的アクセス。
- Integrity
- 低 — 限定的な範囲でデータ変更可能。
- Availability
- なし — 可用性への影響なし。
弱点分類 (CWE)
タイムライン
- 予約済み
- 公開日
- 更新日
- EPSS 更新日
緩和策と回避策翻訳中…
The primary mitigation is to upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. If upgrading is not immediately feasible, consider temporarily disabling the serve.proxy.trustforwardedheaders configuration option. This will prevent Oathkeeper from trusting any X-Forwarded-* headers, effectively disabling the vulnerable functionality. Ensure your reverse proxy or CDN is properly configured to only forward trusted headers and that the protocol matches the original request. Monitor Oathkeeper logs for suspicious activity related to header manipulation.
修正方法翻訳中…
Actualice Ory Oathkeeper a la versión 26.2.0 o superior. Como mitigación adicional, se recomienda eliminar cualquier encabezado inesperado lo antes posible al manejar una solicitud, por ejemplo, en el WAF.
よくある質問翻訳中…
What is CVE-2026-33495 — Authentication Bypass in Ory Oathkeeper?
CVE-2026-33495 is a vulnerability in Ory Oathkeeper allowing attackers to bypass authentication rules by manipulating X-Forwarded-Proto headers. This affects versions before 0.40.10-0.20260320084810-e9acca14a04d, potentially leading to unauthorized access.
Am I affected by CVE-2026-33495 in Ory Oathkeeper?
You are affected if you are running Ory Oathkeeper versions prior to 0.40.10-0.20260320084810-e9acca14a04d and are using the serve.proxy.trustforwardedheaders option. Check your version and configuration immediately.
How do I fix CVE-2026-33495 in Ory Oathkeeper?
Upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. As a temporary workaround, disable the serve.proxy.trustforwardedheaders configuration option.
Is CVE-2026-33495 being actively exploited?
As of the current assessment, CVE-2026-33495 is not known to be actively exploited. However, it's crucial to apply the patch or workaround to prevent potential future exploitation.
Where can I find the official Ory Oathkeeper advisory for CVE-2026-33495?
Refer to the official Ory Oathkeeper security advisory for detailed information and updates regarding CVE-2026-33495: [https://www.ory.sh/security](https://www.ory.sh/security)
このCVEがあなたのプロジェクトに影響するか確認
go.mod ファイルをアップロードすると、影響の有無を即座にお知らせします。
Goプロジェクトを今すぐスキャン — アカウント不要
Upload your go.mod and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...