{
  "threat_severity" : "Important",
  "public_date" : "2026-07-28T12:00:00Z",
  "bugzilla" : {
    "description" : "openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on WSGI/PHP upstreams",
    "id" : "2483253",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2483253"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-436",
  "details" : [ "A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.", "A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application." ],
  "acknowledgement" : "This issue was discovered by Jeremy Choi (Red Hat).",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4.12",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:54206",
    "cpe" : "cpe:/a:redhat:openshift:4.12::el9",
    "package" : "openshift4/ose-oauth-proxy:1786458704"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.13",
    "release_date" : "2026-08-20T00:00:00Z",
    "advisory" : "RHSA-2026:54188",
    "cpe" : "cpe:/a:redhat:openshift:4.13::el9",
    "package" : "openshift4/ose-oauth-proxy:1786477436"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.14",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:50681",
    "cpe" : "cpe:/a:redhat:openshift:4.14::el9",
    "package" : "openshift4/ose-oauth-proxy:1785549818"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.15",
    "release_date" : "2026-08-26T00:00:00Z",
    "advisory" : "RHSA-2026:56912",
    "cpe" : "cpe:/a:redhat:openshift:4.15::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1787054100"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.16",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:50758",
    "cpe" : "cpe:/a:redhat:openshift:4.16::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785544039"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.17",
    "release_date" : "2026-09-03T00:00:00Z",
    "advisory" : "RHSA-2026:60023",
    "cpe" : "cpe:/a:redhat:openshift:4.17::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1787543313"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.18",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:51013",
    "cpe" : "cpe:/a:redhat:openshift:4.18::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785529735"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.19",
    "release_date" : "2026-08-12T00:00:00Z",
    "advisory" : "RHSA-2026:51007",
    "cpe" : "cpe:/a:redhat:openshift:4.19::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785521728"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.2",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:51022",
    "cpe" : "cpe:/a:redhat:openshift:4.20::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785833742"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.21",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:51025",
    "cpe" : "cpe:/a:redhat:openshift:4.21::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785851359"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:51038",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-oauth-proxy-rhel9:1785885351"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-49332\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49332" ],
  "name" : "CVE-2026-49332",
  "mitigation" : {
    "value" : "Upstream application hardening: validate X-Forwarded-User against the expected session identity. Reject requests where identity headers do not match the authenticated session.",
    "lang" : "en:us"
  },
  "csaw" : false
}