CVE-2026-49332

Summary

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat OpenShift Container Platform 4.121786458704 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.131786477436 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.141785549818 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.151787054100 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.161785544039 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.171787543313 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.181785529735 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.191785521728 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.21785833742 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.211785851359 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.221785885351 < *unaffected

Weaknesses

  • CWE-436: Interpretation Conflict

Workarounds

Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References