CVE-2026-49332
High
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
SeverityHigh
CVSS8.5
Exploit probability—
ProductOpenshift 4.12
PublishedJul 28, 2026
First seenJul 28, 2026
Weakness typeCWE-436CWE-436
How to fix
Vendor advisories
- access.redhat.com/errata/RHSA-2026:50681
- access.redhat.com/errata/RHSA-2026:50758
- access.redhat.com/errata/RHSA-2026:51007
- access.redhat.com/errata/RHSA-2026:51013
- access.redhat.com/errata/RHSA-2026:51022
- access.redhat.com/errata/RHSA-2026:51025
- access.redhat.com/errata/RHSA-2026:51038
- access.redhat.com/errata/RHSA-2026:54188
- access.redhat.com/errata/RHSA-2026:54206
- access.redhat.com/errata/RHSA-2026:56912
- access.redhat.com/errata/RHSA-2026:60023
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openshift 4.12 | No range specified | — |
| openshift 4.13 | No range specified | — |
| openshift 4.14 | No range specified | — |
| openshift 4.15 | No range specified | — |
| openshift 4.16 | No range specified | — |
| openshift 4.17 | No range specified | — |
| openshift 4.18 | No range specified | — |
| openshift 4.19 | No range specified | — |
| openshift 4.20 | No range specified | — |
| openshift 4.21 | No range specified | — |
| openshift 4.22 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.