Ory Oathkeeper, an identity and access proxy, used to evaluate HTTP requests against configured access rules, failed to honor the serve.proxy.trust_forwarded_headers setting before version 26.2.0. As a result, it always considered the X-Forwarded-Proto header. An attacker who can supply this header and the application is configured with distinct rules for HTTP and HTTPS can trigger an alternative rule set that may grant unauthorized access. This is a privilege escalation type weakness (CWE‑862).

All installations of Ory Oathkeeper running any version prior to 26.2.0 are affected, regardless of the underlying operating system. The issue exists if the application has separate access rules for http and https traffic and the X-Forwarded-Proto header is present in incoming requests.

The CVSS score of 6.5 reflects a moderate severity when the exploitation conditions are met. EPSS indicates that exploitation is expected to be rare (<1%). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need the ability to send HTTP requests with arbitrary X-Forwarded-* headers to the Oathkeeper proxy, and the system must already contain divergent rule sets for different protocols. In most deployments the conditions for exploitation are unlikely, but in configurations that use protocol‑specific access rules the risk escalates to potential unauthorized access. The likely attack vector is network, with web traffic interception or injection at the proxy or CDN level.