Is CVE-2026-49332 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49332 being exploited in the wild.

How severe is CVE-2026-49332?

High severity, with a CVSS score of 8.5, published 28 July 2026.

Which products and versions are affected?

Red Hat OpenShift Container Platform 4 4; OpenShift oauth-proxy.

Is there a fix for CVE-2026-49332?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49332 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49332?

Check whether you run Red Hat Oauth-Proxy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49332: OpenShift oauth-proxy identity impersonation via header smuggling

CVE-2026-49332 · Severity: high · CVSS 8.5 · Published 2026-07-28

A security flaw in the OpenShift OAuth Proxy allows an authenticated user with low privileges to impersonate other users, including administrators. The proxy fails to properly clean up specific technical labels (headers) in web requests, which can confuse the backend applications it is supposed to protect. This could lead to unauthorized access to sensitive data or administrative functions within the applications running behind the proxy.

Vendors: Red Hat.

Quick answers

Is CVE-2026-49332 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49332 being exploited in the wild.
How severe is CVE-2026-49332?: High severity, with a CVSS score of 8.5, published 28 July 2026.
Which products and versions are affected?: Red Hat OpenShift Container Platform 4 4; OpenShift oauth-proxy.
Is there a fix for CVE-2026-49332?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49332 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49332?: Check whether you run Red Hat Oauth-Proxy. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A flaw was found in openshift/oauth-proxy where the proxy sets authenticated identity headers using dash-variant keys (e.g., X-Forwarded-User) but fails to strip underscore-variant keys (e.g., X_Forwarded_User) from incoming client requests. Because Go's http.Header treats these as distinct keys while WSGI (Django, Flask, FastAPI) and PHP frameworks normalize both to the same CGI variable (HTTP_X_FORWARDED_USER), an attacker can smuggle a forged identity header. By providing an underscore-variant header, the attacker may override the legitimate identity header set by the proxy when it reaches the upstream application. This enables identity impersonation and potential privilege escalation.

Affected products

Red Hat OpenShift Container Platform 4 4
OpenShift oauth-proxy

Timeline

2026-05-29: disclosed: Initial report in Red Hat Bugzilla
2026-07-28: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.