CVE-2023-33189: Pomerium Incorrect Authorization Vulnerability
Summary
CVE-2023-33189: Pomerium vulnerable to Incorrect Authorization with specially crafted requests. Affects github.com/pomerium/pomerium across 6 version ranges.
< 0.17.4
>= 0.18.0, < 0.18.1
>= 0.19.0, < 0.19.2
>= 0.20.0, < 0.20.1
>= 0.21.0, < 0.21.4
>= 0.22.0, < 0.22.2
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pomerium is an open-source tool written in Go that provides secure access to internal applications and services. It acts as a reverse proxy and handles authentication and authorization for incoming requests. Pomerium ensures that only authorized users can access protected resources. However, a vulnerability has been discovered in Pomerium that allows for incorrect authorization decisions to be made.
Vulnerability Detail
The vulnerability in Pomerium arises from the handling of specially crafted requests. Attackers can exploit this vulnerability to bypass the intended authorization mechanism and gain unauthorized access to protected resources. This can lead to unauthorized data exposure, privilege escalation, and other security breaches. The vulnerability has been assigned a CVSS score of 10.0, indicating its critical severity.
How To Fix
Latest published version: v0.33.4 as of 22 Oct 2026
go get github.com/pomerium/pomerium@v0.33.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.17.40.17.4go get github.com/pomerium/pomerium@v0.17.4 -
>= 0.18.0, < 0.18.10.18.1go get github.com/pomerium/pomerium@v0.18.1 -
>= 0.19.0, < 0.19.20.19.2go get github.com/pomerium/pomerium@v0.19.2 -
>= 0.20.0, < 0.20.10.20.1go get github.com/pomerium/pomerium@v0.20.1 -
>= 0.21.0, < 0.21.40.21.4go get github.com/pomerium/pomerium@v0.21.4 -
>= 0.22.0, < 0.22.20.22.2go get github.com/pomerium/pomerium@v0.22.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Pomerium Incorrect Authorization Vulnerability allows attackers to bypass the authorization mechanism and gain unauthorized access to protected resources. It is crucial to upgrade to the patched versions of Pomerium (v0.22.2, v0.21.4, v0.20.1, v0.19.2, v0.18.1, or v0.17.4) to mitigate this vulnerability. For further support or assistance, please contact the Pomerium development team at security@pomerium.com.
See every vulnerability recorded for github.com/pomerium/pomerium →
FAQ
This vulnerability allows attackers to bypass the authorization mechanism in Pomerium, potentially gaining unauthorized access to protected resources. It can lead to data exposure, privilege escalation, and other security breaches.
You can use the Vulert Playground at Vulert Scanner to check if your version of Pomerium is affected by this vulnerability. Simply input your Gopkg.lock file, and Vulert will provide real-time alerts for open-source vulnerabilities, including this one.
No specific workarounds have been provided for this vulnerability. It is recommended to upgrade to the patched versions of Pomerium to mitigate the issue.
To upgrade your Pomerium installation, follow the upgrade instructions provided by the Pomerium project. These instructions can be found in the project's documentation or on their GitHub repository.
For further support regarding vulnerability remediation or any other questions related to Pomerium, you can reach out to the Pomerium development team by opening an issue in their GitHub repository or by emailing them at security@pomerium.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pomerium/pomerium.
