Bug 2483181 (CVE-2026-46579)

Summary: CVE-2026-46579 openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-29 09:28:43 UTC 
The OpenShift Router's HAProxy configuration template sets X-SSL-Client-* headers (DN, DER, NotAfter, NotBefore, SHA1, Subject) on the HTTPS frontends (fe_sni, fe_no_sni) using values from the actual TLS handshake. However, the HTTP frontend (fe_http) does not strip these headers from incoming requests. When a Route has insecureEdgeTerminationPolicy set to Allow, an attacker can send plain HTTP requests with forged X-SSL-Client-* headers that are forwarded to the backend unmodified. Backends that rely on these headers for mutual TLS authentication can be completely bypassed, allowing an unauthenticated attacker to impersonate any client certificate identity.