CVE-2026-33494 Ory Oathkeeper 路径遍历漏洞，已修复

Ory Oathkeeper 中的 CVE-2026-33494 存在 HTTP 路径遍历导致的授权绕过漏洞。攻击者可以构造包含路径遍历序列（例如 /public/../admin/secrets）的 URL，该 URL 在归一化后解析为受保护的路径，但由于原始未归一化的路径在规则评估期间被使用，因此与宽松的规则匹配。这可能导致对敏感资源的未经授权的访问。

Organizations relying on Ory Oathkeeper for authentication, particularly those with complex rule configurations or legacy deployments, are at risk. Shared hosting environments where Oathkeeper instances are configured with permissive rules are also particularly vulnerable.

• linux / server:

journalctl -u oathkeeper -g "path traversal"

• generic web:

curl -I 'http://your-oathkeeper-server/public/../admin/secrets' # Check for unexpected responses

• generic web:

grep -r '/../' /var/log/nginx/access.log # Look for path traversal attempts in access logs

1. 2026-03-20Disclosure

   disclosure

1. 已保留2026-03-20
2. 发布日期2026-03-20
3. 修改日期2026-03-27
4. EPSS 更新日期2026-04-03

此漏洞的缓解措施是升级到 Ory Oathkeeper 的 0.40.10-0.20260320084758-8e0002140491 或更高版本。此版本通过确保使用归一化路径评估规则来修复此问题，从而防止授权绕过。建议审查和更新 Oathkeeper 规则，以确保其符合安全原则并最大限度地减少攻击面。