Is CVE-2026-34457 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34457 being exploited in the wild.

How severe is CVE-2026-34457?

Critical severity, with a CVSS score of 9.1, published 14 April 2026.

Which products and versions are affected?

github.com/oauth2-proxy/oauth2-proxy (Go) <= 3.2.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.2.0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) < 7.15.2, SEMVER:introduced=0,fixed=7.15.2; OAuth2 Proxy < 7.15.2.

Is there a fix for CVE-2026-34457?

Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34457 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34457?

Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34457: OAuth2 Proxy authentication bypass via health check User-Agent spoofing

Q: Is there a fix for CVE-2026-34457?

Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34457 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-34457?

Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34457 · Severity: critical · CVSS 9.1 · Published 2026-04-14

OAuth2 Proxy, a tool used to secure web applications by requiring login via providers like Google or GitHub, contains a flaw that allows attackers to bypass security checks. By mimicking a specific "User-Agent" string used for system health monitoring, an unauthorized user can gain full access to protected internal resources without logging in. This could lead to the exposure of sensitive customer data or unauthorized access to internal corporate tools.

Technologies: github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go), OAuth2 Proxy. Vendors: Go, OAuth2 Proxy.

Quick answers

Is CVE-2026-34457 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34457 being exploited in the wild.
How severe is CVE-2026-34457?: Critical severity, with a CVSS score of 9.1, published 14 April 2026.
Which products and versions are affected?: github.com/oauth2-proxy/oauth2-proxy (Go) <= 3.2.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.2.0; github.com/oauth2-proxy/oauth2-proxy/v7 (Go) < 7.15.2, SEMVER:introduced=0,fixed=7.15.2; OAuth2 Proxy < 7.15.2.
Is there a fix for CVE-2026-34457?: Yes. github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34457 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34457?: Check whether you run github.com/oauth2-proxy/oauth2-proxy (Go), github.com/oauth2-proxy/oauth2-proxy/v7 (Go) or OAuth2 Proxy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/oauth2-proxy/oauth2-proxy/v7 (Go): upgrade to 7.15.2 or later
```
go get github.com/oauth2-proxy/oauth2-proxy/v7@v7.15.2
```

Technical details

An authentication bypass exists in OAuth2 Proxy versions prior to 7.15.2 due to improper validation of health check requests. When configured with an auth_request-style integration (e.g., Nginx auth_request) and either --ping-user-agent or --gcp-healthchecks enabled, the proxy incorrectly treats any request containing the designated health check User-Agent as a valid, authenticated session. This occurs regardless of the requested URL path. An unauthenticated remote attacker can exploit this by spoofing the User-Agent header to match the configured health check string, thereby bypassing the OAuth2 flow and accessing upstream protected resources. The issue is resolved in version 7.15.2.

Affected products

OAuth2 Proxy Project OAuth2 Proxy < 7.15.2

Identifiers

CVE-2026-34457
GHSA-5hvv-m4w4-gf6v
GO-2026-5147

Timeline

2026-04-14: disclosed
2026-04-14: patched: Fixed in version 7.15.2
2026-04-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.