Read the docs
TI-2026-25890 Aliases CVE-2026-33494GHSA-p224-6x5r-fjpm

Ory Oathkeeper has a path traversal authorization bypass

Priority MEDIUM 49CWE-23Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Fixed oathkeeper (ory): 26.2.0github.com/ory/oathkeeper (Go): 0.40.10-0.20260320084758-8e0002140491

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oryoathkeeperbefore 26.2.026.2.0Patch availableCNA
—github.com/ory/oathkeeper (Go)before 0.40.10-0.20260320084758-8e00021404910.40.10-0.20260320084758-8e0002140491Patch availableGHSA-p224-6x5r-fjpm
  • oathkeeper Vendorory Affected before 26.2.0 Fixed in 26.2.0 Patch available CNA
  • github.com/ory/oathkeeper (Go) Vendor— Affected before 0.40.10-0.20260320084758-8e0002140491 Fixed in 0.40.10-0.20260320084758-8e0002140491 Patch available GHSA-p224-6x5r-fjpm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*before 26.2.0Vulnerableory
  • cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:* Versions before 26.2.0 Vulnerable ·ory

Remediation

  • Fix · CNA oathkeeper (ory) Fixed in 26.2.0
  • Fix · GHSA-p224-6x5r-fjpm github.com/ory/oathkeeper (Go) Fixed in 0.40.10-0.20260320084758-8e0002140491 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33494
  2. 2026-10-03 Alias added: GHSA-p224-6x5r-fjpm
  3. 2026-10-23 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2021-12369 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled CVSS 3.1HIGH 7.5
  • TI-2026-25892 Ory Oathkeeper has an authentication bypass by cache key confusion CVSS 3.1HIGH 8.1
  • TI-2026-25891 Ory Oathkeeper has an authentication bypass by usage of untrusted header CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences