Bug 2483253 (CVE-2026-49332)

Summary: CVE-2026-49332 openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on WSGI/PHP upstreams
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-29 13:30:03 UTC 
openshift/oauth-proxy sets authenticated identity headers using dash-variant keys only (req.Header["X-Forwarded-User"] at oauthproxy.go:810,816) but does not strip underscore-variant keys (X_Forwarded_User) from client requests. Go's http.Header treats these as separate keys via textproto.CanonicalMIMEHeaderKey. WSGI frameworks (Django, Flask, FastAPI) and PHP normalize both to the same CGI variable (HTTP_X_FORWARDED_USER per PEP 3333), allowing a low-privilege authenticated attacker to inject X_Forwarded_User: admin which may override the proxy-set authenticated identity in the upstream application. The community oauth2-proxy fixed this in v7.13.0 (CVE-2025-64484, GHSA-vjrc-mh2v-45x6) with header normalization. This fix was never ported to openshift/oauth-proxy.