← Back

CVE-2026-33494

nvd nist
Published: Mar 26, 2026Modified: Jun 17, 2026

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.8
Source: security-advisories@github.com (Secondary)

Description

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.

Affected (1)

Products: Ory: Oathkeeper
Ory
1 product
Oathkeeper
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Oathkeeper
Before 26.2.0

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (2)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
MitigationVendor Advisory

Timeline

No history available yet.