CVE-2026-49331

Name of the Vulnerable Software and Affected Versions openshift/oauth-proxy (affected versions not specified)

Description A flaw exists where the proxy fails to strip client-supplied identity headers on paths configured to bypass authentication via the skip-auth-regex setting. This allows an unauthenticated attacker to inject forged identity headers, specifically X-Forwarded-User, X-Forwarded-Email, and X-Forwarded-Access-Token, which are then forwarded to the upstream application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.