Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-33495: Authentication Bypass in Ory Oathkeeper
Plataforma
go
Componente
github.com/ory/oathkeeper
Corrigido em
0.40.10-0.20260320084810-e9acca14a04d
CVE-2026-33495 describes an Authentication Bypass vulnerability in Ory Oathkeeper, a component often used for authentication and authorization. This vulnerability arises when Oathkeeper trusts X-Forwarded-Proto headers, allowing attackers to potentially bypass authentication rules if the proxy configuration is not secure. Versions prior to 0.40.10-0.20260320084810-e9acca14a04d are affected, and a patch is available.
Detecte esta CVE no seu projeto
Envie seu arquivo go.mod e descubra na hora se você está afetado.
Impacto e Cenários de Ataquetraduzindo…
An attacker exploiting this vulnerability could bypass authentication checks within Ory Oathkeeper. This is particularly concerning when Oathkeeper is deployed behind reverse proxies or CDNs. By manipulating the X-Forwarded-Proto header, an attacker could trick Oathkeeper into thinking a request is using HTTPS when it's actually HTTP, or vice versa. This could lead to unauthorized access to protected resources or services that rely on Oathkeeper for authentication. The impact is amplified if Oathkeeper is a central authentication point for multiple applications, as a successful exploit could compromise a wider range of systems.
Contexto de Exploraçãotraduzindo…
CVE-2026-33495 was published on 2026-03-20. The vulnerability's severity is Medium. No public exploits or active campaigns have been reported at the time of writing. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Review the official Ory Oathkeeper advisory for further details.
Inteligência de Ameaças
Status do Exploit
EPSS
0.03% (percentil 10%)
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Nenhuma — ataque automático e silencioso. A vítima não faz nada.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Baixo — acesso parcial ou indireto a alguns dados.
- Integrity
- Baixo — o atacante pode modificar alguns dados com alcance limitado.
- Availability
- Nenhum — sem impacto na disponibilidade.
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
- EPSS atualizado
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation is to upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. If upgrading is not immediately feasible, consider temporarily disabling the serve.proxy.trustforwardedheaders configuration option. This will prevent Oathkeeper from trusting any X-Forwarded-* headers, effectively disabling the vulnerable functionality. Ensure your reverse proxy or CDN is properly configured to only forward trusted headers and that the protocol matches the original request. Monitor Oathkeeper logs for suspicious activity related to header manipulation.
Como corrigirtraduzindo…
Actualice Ory Oathkeeper a la versión 26.2.0 o superior. Como mitigación adicional, se recomienda eliminar cualquier encabezado inesperado lo antes posible al manejar una solicitud, por ejemplo, en el WAF.
Perguntas frequentestraduzindo…
What is CVE-2026-33495 — Authentication Bypass in Ory Oathkeeper?
CVE-2026-33495 is a vulnerability in Ory Oathkeeper allowing attackers to bypass authentication rules by manipulating X-Forwarded-Proto headers. This affects versions before 0.40.10-0.20260320084810-e9acca14a04d, potentially leading to unauthorized access.
Am I affected by CVE-2026-33495 in Ory Oathkeeper?
You are affected if you are running Ory Oathkeeper versions prior to 0.40.10-0.20260320084810-e9acca14a04d and are using the serve.proxy.trustforwardedheaders option. Check your version and configuration immediately.
How do I fix CVE-2026-33495 in Ory Oathkeeper?
Upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. As a temporary workaround, disable the serve.proxy.trustforwardedheaders configuration option.
Is CVE-2026-33495 being actively exploited?
As of the current assessment, CVE-2026-33495 is not known to be actively exploited. However, it's crucial to apply the patch or workaround to prevent potential future exploitation.
Where can I find the official Ory Oathkeeper advisory for CVE-2026-33495?
Refer to the official Ory Oathkeeper security advisory for detailed information and updates regarding CVE-2026-33495: [https://www.ory.sh/security](https://www.ory.sh/security)
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Detecte esta CVE no seu projeto
Envie seu arquivo go.mod e descubra na hora se você está afetado.
Escaneie seu projeto Go agora — sem conta
Envie seu go.mod e receba o relatório de vulnerabilidades instantaneamente. Sem conta. Enviar o arquivo é só o começo: com uma conta você obtém monitoramento contínuo, alertas por Slack/e-mail, relatórios multi-projeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...