CVE-2026-49332 in OpenShift Container Platform
Summary
by MITRE • 07/28/2026
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability exists within the openshift/oauth-proxy component where authentication identity headers are handled inconsistently, creating a potential security risk for applications relying on this proxy for authentication. This flaw stems from the proxy's implementation of header processing where it only strips dash-variant keys such as X-Forwarded-User while leaving underscore-variant keys like X_Forwarded_User intact in incoming requests. The issue manifests when WSGI and PHP frameworks process these headers, as they normalize both dash and underscore variants to the same internal variable, effectively treating them as equivalent. This normalization behavior creates an attack surface where malicious actors can manipulate request headers to inject forged identity information that bypasses normal authentication mechanisms.
The technical flaw represents a classic case of header manipulation and injection vulnerability where the proxy fails to properly sanitize all variants of authenticated identity headers. When an attacker crafts a request containing both X-Forwarded-User and X_Forwarded_User headers, or even just the underscore variant, the upstream application processing layer normalizes these to identical internal variables, allowing the forged identity information to override legitimate authentication data. This behavior violates fundamental security principles around header sanitization and consistent authentication handling across different application frameworks that may interpret the same header in different ways.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows authenticated low-privilege users to manipulate upstream applications by crafting specific request headers that can override legitimate user identities. Attackers exploiting this weakness could potentially impersonate other users within the system, access restricted resources, or gain unauthorized privileges depending on how the upstream application processes these normalized headers. The vulnerability is particularly concerning in environments where applications rely heavily on header-based authentication and authorization mechanisms, as it effectively undermines the integrity of the authentication chain.
Organizations using openshift/oauth-proxy should immediately implement mitigations that ensure all variants of authenticated identity headers are consistently stripped or sanitized regardless of their naming convention. This includes updating proxy configurations to remove both dash and underscore variants of identity headers from incoming requests before forwarding them to upstream applications. The fix should align with security best practices outlined in cwe-20 and attack techniques related to header manipulation and credential smuggling. Additionally, organizations should implement monitoring and logging for unusual header patterns that might indicate exploitation attempts, as well as consider implementing additional authentication layers or authorization checks within applications to provide defense-in-depth against such header-based attacks.