Executive brief
A downstream service can be reached through two different authentication paths, and a routing rule incorrectly selects between them based on a header value that an attacker can control. A low-privileged authenticated user who knows a shared service credential can manipulate this header to bypass role-based authorization checks and gain access to higher-privileged functions, potentially allowing unauthorized administrative actions or data access.
Technical details
This vulnerability is a privilege escalation resulting from improper authentication mechanism selection based on untrusted input. The vulnerable component is a routing rule that decides which authentication path to use (primary or alternate) based on a client-supplied request header rather than an immutable property (e.g., client IP, certificate, or service identity). An authenticated attacker with knowledge of a shared credential can craft a request with a malicious header value to route around the primary role-based access control check and reach an alternate path with fixed, elevated privileges. This allows privilege escalation from a low-privileged role to a higher-privileged role without additional authentication or authorization. Attack vector is network-based and requires prior authentication and knowledge of the shared credential; no patch information is currently available.
Affected products
- <UNKNOWN> <UNKNOWN>
Timeline
- 2026-09-11: disclosed