Executive brief
Ory Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper
Affected products
- Go github.com/ory/oathkeeper
Junglewise Threat Intelligence
CVE-2026-33494: GO-2026-4804 - Ory Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper
CVE-2026-33494 · Severity: low · CVSS 3.1 · Published 2026-03-23
Technologies: github.com/ory/oathkeeper (Go). Vendors: Go.
Related threats
- GO-2026-4810 - Ory Oathkeeper has an authentication bypass by usage of untrusted header in github.com/ory/oathkeeper
- GO-2026-4799 - Ory Oathkeeper has an authentication bypass by cache key confusion in github.com/ory/oathkeeper
- GO-2022-0920 - Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper
- GO-2022-0406 - Possible bypass of token claim validation when OAuth2 Introspection caching is enabled in github.com/ory/oathkeeper
- GO-2023-1747 - Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper