8.5
Élevée
CVE-2026-49332 A flaw was found in openshift/oauth-proxy
Description
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.21 1785851359 | premières → < 1785851359 | 1785851359 |
| Red Hat OpenShift Container Platform 4.20 1785833742 | premières → < 1785833742 | 1785833742 |
| Red Hat OpenShift Container Platform 4.22 1785885351 | premières → < 1785885351 | 1785885351 |
| Red Hat OpenShift Container Platform 4.18 1785529735 | premières → < 1785529735 | 1785529735 |
| Red Hat OpenShift Container Platform 4.19 1785521728 | premières → < 1785521728 | 1785521728 |
| Red Hat OpenShift Container Platform 4.14 1785549818 | premières → < 1785549818 | 1785549818 |
| Red Hat OpenShift Container Platform 4.16 1785544039 | premières → < 1785544039 | 1785544039 |
| Red Hat OpenShift Container Platform 4.2 1785833742 | premières → < 1785833742 | 1785833742 |
Afficher les 4 autres branches Masquer les 4 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4.12 1786458704 | premières → < 1786458704 | 1786458704 |
| Red Hat OpenShift Container Platform 4.13 1786477436 | premières → < 1786477436 | 1786477436 |
| Red Hat OpenShift Container Platform 4.15 1787054100 | premières → < 1787054100 | 1787054100 |
| Red Hat OpenShift Container Platform 4.17 1787543313 | premières → < 1787543313 | 1787543313 |
Autres CVE de Red Hat OpenShift Container Platform 4
Les 630 CVE de Red Hat OpenShift Container Platform 4 →
CVE-2026-123876
Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation
4.4
Moyenne
CVE-2026-123037
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
6.7
Moyenne
CVE-2026-82976
Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret
7.1
Élevée
CVE-2026-120831
Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
6.5
Moyenne