8.5
High
CVE-2026-49332 A flaw was found in openshift/oauth-proxy
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 4.21 1785851359 | earliest → < 1785851359 | 1785851359 |
| Red Hat OpenShift Container Platform 4.20 1785833742 | earliest → < 1785833742 | 1785833742 |
| Red Hat OpenShift Container Platform 4.22 1785885351 | earliest → < 1785885351 | 1785885351 |
| Red Hat OpenShift Container Platform 4.18 1785529735 | earliest → < 1785529735 | 1785529735 |
| Red Hat OpenShift Container Platform 4.19 1785521728 | earliest → < 1785521728 | 1785521728 |
| Red Hat OpenShift Container Platform 4.14 1785549818 | earliest → < 1785549818 | 1785549818 |
| Red Hat OpenShift Container Platform 4.16 1785544039 | earliest → < 1785544039 | 1785544039 |
| Red Hat OpenShift Container Platform 4.2 1785833742 | earliest → < 1785833742 | 1785833742 |
Show the 4 other branches Hide the 4 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 1786458704 | earliest → < 1786458704 | 1786458704 |
| Red Hat OpenShift Container Platform 4.13 1786477436 | earliest → < 1786477436 | 1786477436 |
| Red Hat OpenShift Container Platform 4.15 1787054100 | earliest → < 1787054100 | 1787054100 |
| Red Hat OpenShift Container Platform 4.17 1787543313 | earliest → < 1787543313 | 1787543313 |
Other CVEs of Red Hat OpenShift Container Platform 4
The 630 CVEs of Red Hat OpenShift Container Platform 4 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Medium
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Medium
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
High
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Medium