Description
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.
Published: 2026-03-26
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass via Path Traversal
Action: Immediate Patch
AI Analysis

Impact

Ory Oathkeeper, an Identity & Access Proxy, fails to normalize URL paths when evaluating access rules. An attacker can send a request such as "/public/../admin/secrets"; after normalization the request targets a protected route, but the raw, un-normalized path is used in rule evaluation. The permissive rule matches the raw path, granting the attacker unauthorized access to the protected resource. This enables confidential data exposure and other privileged actions.

Affected Systems

The vulnerability affects Ory Oathkeeper versions prior to 26.2.0. Users running 26.2.0 or later are not affected.

Risk and Exploitability

The CVSS score is 10, indicating the highest severity, but the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via crafted HTTP requests and requires no special privileges or local access.

Generated by OpenCVE AI on April 7, 2026 at 23:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Ory Oathkeeper to version 26.2.0 or later.

Generated by OpenCVE AI on April 7, 2026 at 23:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-p224-6x5r-fjpm Ory Oathkeeper has a path traversal authorization bypass
History

Tue, 07 Apr 2026 21:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*

Fri, 27 Mar 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 27 Mar 2026 08:45:00 +0000

Type Values Removed Values Added
First Time appeared Ory
Ory oathkeeper
Vendors & Products Ory
Ory oathkeeper

Thu, 26 Mar 2026 17:45:00 +0000

Type Values Removed Values Added
Description ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.
Title Ory Oathkeeper has a path traversal authorization bypass
Weaknesses CWE-23
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Ory Oathkeeper
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-03-27T13:58:20.111Z

Reserved: 2026-03-20T16:59:08.887Z

Link: CVE-2026-33494

cve-icon Vulnrichment

Updated: 2026-03-27T13:48:28.470Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-26T18:16:30.400

Modified: 2026-04-07T21:15:14.387

Link: CVE-2026-33494

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-08T20:01:13Z

Weaknesses