CVE-2026-49332: OpenShift OAuth Proxy Header Smuggling Vulnerability

A significant flaw, identified as CVE-2026-49332, has been discovered in the openshift/oauth-proxy component of Red Hat OpenShift Container Platform 4. This vulnerability enables an authenticated user with low privileges to bypass identity checks and achieve privilege escalation within upstream applications. The core issue stems from the proxy's inconsistent handling of HTTP headers; while it uses dash-variant keys (e.g., X-Forwarded-User) to set authenticated identity, it fails to strip underscore-variant keys (e.g., X_Forwarded_User) from incoming requests. This oversight allows an attacker to include a forged X_Forwarded_User header. Upstream application frameworks, such as WSGI and PHP, commonly normalize both dash and underscore variants to the same internal variable, leading to the forged identity overriding the legitimate one established by the proxy. This can result in unauthorized access or actions performed under a higher-privileged identity.

Attack Chain

1. An authenticated user with low privileges crafts a malicious HTTP request targeting an upstream application protected by the openshift/oauth-proxy.
2. The malicious request includes a forged X_Forwarded_User header containing a desired high-privilege identity (e.g., an administrator).
3. The openshift/oauth-proxy receives this request and, as designed, authenticates the legitimate low-privilege user, then adds its own X-Forwarded-User header (dash variant) reflecting this authenticated identity.
4. However, the oauth-proxy fails to remove the attacker-supplied X_Forwarded_User header (underscore variant) before forwarding the request to the upstream application.
5. The upstream application (e.g., developed with WSGI or PHP frameworks) receives the request containing both the legitimate X-Forwarded-User header from the proxy and the forged X_Forwarded_User header from the attacker.
6. Due to internal header normalization logic within these frameworks, both X-Forwarded-User and X_Forwarded_User are mapped to the same internal variable, with the forged underscore-variant often taking precedence.
7. The upstream application incorrectly processes the request using the forged, high-privilege identity supplied by the attacker, leading to privilege escalation or unauthorized actions.

Impact

Successful exploitation of CVE-2026-49332 allows an authenticated low-privilege user to effectively impersonate a higher-privileged user in upstream applications. This can lead to unauthorized access to sensitive data, execution of administrative functions, or complete compromise of the affected application's functionality. While the NVD entry does not specify the number of victims or targeted sectors, the vulnerability applies to any deployment of Red Hat OpenShift Container Platform 4 utilizing the openshift/oauth-proxy in conjunction with upstream applications that normalize HTTP header variants. The CVSS v3.1 base score of 8.5 (High) reflects the significant security risk posed by this vulnerability.

Recommendation

• Patch CVE-2026-49332 immediately by applying the latest security updates provided by Red Hat for your affected Red Hat OpenShift Container Platform 4 installations.
• Refer to the official Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-49332 for detailed patching instructions and mitigation strategies.
• Review the Red Hat bug report at https://bugzilla.redhat.com/show_bug.cgi?id=2483253 for additional technical details and discussions.