此页面尚未翻译为您的语言。我们正在努力翻译，目前显示英文内容。
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-33495: Authentication Bypass in Ory Oathkeeper
平台
go
组件
github.com/ory/oathkeeper
修复版本
0.40.10-0.20260320084810-e9acca14a04d
CVE-2026-33495 describes an Authentication Bypass vulnerability in Ory Oathkeeper, a component often used for authentication and authorization. This vulnerability arises when Oathkeeper trusts X-Forwarded-Proto headers, allowing attackers to potentially bypass authentication rules if the proxy configuration is not secure. Versions prior to 0.40.10-0.20260320084810-e9acca14a04d are affected, and a patch is available.
检测此 CVE 是否影响你的项目
上传你的 go.mod 文件，立即知道是否受影响。
影响与攻击场景翻译中…
An attacker exploiting this vulnerability could bypass authentication checks within Ory Oathkeeper. This is particularly concerning when Oathkeeper is deployed behind reverse proxies or CDNs. By manipulating the X-Forwarded-Proto header, an attacker could trick Oathkeeper into thinking a request is using HTTPS when it's actually HTTP, or vice versa. This could lead to unauthorized access to protected resources or services that rely on Oathkeeper for authentication. The impact is amplified if Oathkeeper is a central authentication point for multiple applications, as a successful exploit could compromise a wider range of systems.
利用背景翻译中…
CVE-2026-33495 was published on 2026-03-20. The vulnerability's severity is Medium. No public exploits or active campaigns have been reported at the time of writing. It is not currently listed on KEV or EPSS, indicating a low to medium probability of exploitation. Review the official Ory Oathkeeper advisory for further details.
威胁情报
漏洞利用状态
EPSS
0.03% (10% 百分位)
CISA SSVC
CVSS 向量
这些指标意味着什么？
- Attack Vector
- 网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
- Attack Complexity
- 低 — 无需特殊条件，可以稳定地利用漏洞。
- Privileges Required
- 无 — 无需认证，无需凭证即可利用。
- User Interaction
- 无 — 攻击自动且无声，受害者无需任何操作。
- Scope
- 未改变 — 影响仅限于脆弱组件本身。
- Confidentiality
- 低 — 可访问部分数据。
- Integrity
- 低 — 攻击者可修改部分数据，影响有限。
- Availability
- 无 — 无可用性影响。
弱点分类 (CWE)
时间线
- 已保留
- 发布日期
- 修改日期
- EPSS 更新日期
缓解措施和替代方案翻译中…
The primary mitigation is to upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. If upgrading is not immediately feasible, consider temporarily disabling the serve.proxy.trustforwardedheaders configuration option. This will prevent Oathkeeper from trusting any X-Forwarded-* headers, effectively disabling the vulnerable functionality. Ensure your reverse proxy or CDN is properly configured to only forward trusted headers and that the protocol matches the original request. Monitor Oathkeeper logs for suspicious activity related to header manipulation.
修复方法翻译中…
Actualice Ory Oathkeeper a la versión 26.2.0 o superior. Como mitigación adicional, se recomienda eliminar cualquier encabezado inesperado lo antes posible al manejar una solicitud, por ejemplo, en el WAF.
常见问题翻译中…
What is CVE-2026-33495 — Authentication Bypass in Ory Oathkeeper?
CVE-2026-33495 is a vulnerability in Ory Oathkeeper allowing attackers to bypass authentication rules by manipulating X-Forwarded-Proto headers. This affects versions before 0.40.10-0.20260320084810-e9acca14a04d, potentially leading to unauthorized access.
Am I affected by CVE-2026-33495 in Ory Oathkeeper?
You are affected if you are running Ory Oathkeeper versions prior to 0.40.10-0.20260320084810-e9acca14a04d and are using the serve.proxy.trustforwardedheaders option. Check your version and configuration immediately.
How do I fix CVE-2026-33495 in Ory Oathkeeper?
Upgrade to version 0.40.10-0.20260320084810-e9acca14a04d or later. As a temporary workaround, disable the serve.proxy.trustforwardedheaders configuration option.
Is CVE-2026-33495 being actively exploited?
As of the current assessment, CVE-2026-33495 is not known to be actively exploited. However, it's crucial to apply the patch or workaround to prevent potential future exploitation.
Where can I find the official Ory Oathkeeper advisory for CVE-2026-33495?
Refer to the official Ory Oathkeeper security advisory for detailed information and updates regarding CVE-2026-33495: [https://www.ory.sh/security](https://www.ory.sh/security)
检测此 CVE 是否影响你的项目
上传你的 go.mod 文件，立即知道是否受影响。
立即扫描您的Go项目 — 无需账户
Upload your go.mod and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
拖放您的依赖文件
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...