Read the docs
TI-2026-53671 Aliases CVE-2026-76835GHSA-vvqv-7vrf-88vh

OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set

Priority HIGH 81CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00453 39th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
oauth2-proxyoauth2-proxy7.15.2 – 7.15.4—No fix listedCNA
  • oauth2-proxy Vendoroauth2-proxy Affected 7.15.2 – 7.15.4 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*——oauth2-proxy
  • cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:* Versions — — ·oauth2-proxy

Remediation

Red Hat 1 advisory

  • RHSA-2026:74536 Released 2026-10-01 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images oauth2-proxy-7.15.5-0.1.hum1@aarch64, oauth2-proxy-7.15.5-0.1.hum1@src, oauth2-proxy-7.15.5-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:74536
Not affected: 3 products
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat OpenShift Dev Spaces

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76835
  2. 2026-10-03 Alias added: GHSA-vvqv-7vrf-88vh
  3. 2026-10-21 Affected versions changed · Red Hat

References

Advisory 1

Other 3

  • TI-2025-34353 OAuth2-Proxy has authentication bypass in oauth2-proxy skip_auth_routes due to Query Parameter inclusion CVSS 3.1CRITICAL 9.1
  • TI-2026-29315 OAuth2 Proxy has an Authentication Bypass via X-Forwarded-Uri Header Spoofing CVSS 3.1CRITICAL 9.1
  • TI-2026-26722 OAuth2 Proxy: Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVSS 3.1CRITICAL 9.1
  • TI-2026-29698 OAuth2 Proxy has an Authentication Bypass via Fragment Confusion in skip_auth_routes and skip_auth_regex CVSS 3.1HIGH 8.2
  • TI-2017-14408 CSRF in Bitly oauth2_proxy 2.1 during authentication flow CVSS 3.0HIGH 8.8
  • TI-2025-39876 OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation CVSS 3.1HIGH 8.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences