Description
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
Published: 2026-08-24
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Patch Immediately
AI Analysis

Impact

The vulnerability causes OAuth2 Proxy to honor client‑supplied X‑Forwarded‑Uri headers when determining whether to skip authentication. In the default configuration the guard added for CVE‑2026‑40575 is inactive, and the trust check for forwarded headers falls back to a universal IP block (0.0.0.0/0 and ::/0). As a result, any client is treated as a trusted proxy and can set X‑Forwarded‑Uri to an allow‑listed path, leading the proxy to skip authentication for protected resources. This constitutes a serious Authentication Bypass that permits an unauthenticated attacker to access upstream services meant to be protected.

Affected Systems

OAuth2 Proxy versions 7.15.2 through 7.15.4 are affected. All installations that enable reverse proxy mode without a proper trusted_proxy_ip configuration are vulnerable.

Risk and Exploitability

The CVSS score of 9.3 indicates a critical severity. Although the EPSS score is not available, the vulnerability’s design—where every client is implicitly trusted—makes exploitation straightforward for any external user. The issue is not currently listed in the CISA KEV catalog, but the broad trust model raises its exploitability in real‑world deployments.

Generated by OpenCVE AI on August 24, 2026 at 20:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OAuth2 Proxy to version 7.15.5 or later, which eliminates the default trust of all IPs when reverse_proxy mode is enabled.
  • Configure the trusted_proxy_ip setting to include only known, internal proxy IPs, ensuring that no external hosts are trusted for forwarded headers.
  • If upgrade is not immediately possible, disable reverse_proxy mode or set reverse_proxy=false to revert to the stricter default behavior and prevent bypass attempts.

Generated by OpenCVE AI on August 24, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
Description OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
Title OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
First Time appeared Oauth2 Proxy Project
Oauth2 Proxy Project oauth2 Proxy
Weaknesses CWE-290
CPEs cpe:2.3:a:oauth2_proxy_project:oauth2_proxy:*:*:*:*:*:*:*:*
Vendors & Products Oauth2 Proxy Project
Oauth2 Proxy Project oauth2 Proxy
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Oauth2 Proxy Project Oauth2 Proxy
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-29T11:47:48.465Z

Reserved: 2026-08-19T20:34:00.154Z

Link: CVE-2026-76835

cve-icon Vulnrichment

Updated: 2026-08-24T20:00:29.738Z

cve-icon NVD

Status : Received

Published: 2026-08-24T18:17:21.570

Modified: 2026-08-24T20:17:19.623

Link: CVE-2026-76835

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T20:30:07Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing