Attack Chain

1. An attacker identifies an OpenShift Route configured with insecureEdgeTerminationPolicy set to “Allow”.
2. The attacker crafts a plain HTTP request containing malicious X-SSL-Client-* headers.
3. The attacker sends the crafted HTTP request to the OpenShift Router.
4. The Router, due to the misconfiguration, forwards the request with the attacker-controlled X-SSL-Client-* headers to the backend service.
5. The backend service, incorrectly trusting the X-SSL-Client-* headers due to the lack of sanitization by the Router, authenticates the attacker as a legitimate client.
6. The attacker gains unauthorized access to the backend service, impersonating the client certificate identity.
7. The attacker performs unauthorized actions, such as accessing sensitive data or executing privileged operations.

Impact

Successful exploitation of CVE-2026-46579 allows an unauthenticated attacker to bypass mutual TLS authentication in OpenShift environments. This can lead to unauthorized access to sensitive resources, privilege escalation, and data breaches. The number of affected deployments depends on the prevalence of the vulnerable insecureEdgeTerminationPolicy configuration. Organizations relying on mutual TLS for securing backend services are at significant risk.

Recommendation

• Apply the latest security patches to the OpenShift Router to address CVE-2026-46579.
• Review all OpenShift Route configurations to ensure that insecureEdgeTerminationPolicy is not set to “Allow” where mutual TLS authentication is required.
• Implement the Sigma rule “Detect OpenShift Router mTLS Bypass Attempt via X-SSL-Client Headers” to detect attempts to exploit this vulnerability.
• Monitor web server logs for suspicious X-SSL-Client-* headers originating from unexpected sources or containing unusual values.