CVE-2026-33494: Ory Oathkeeper Path Traversal Authorization Bypass Vulnerability
Summary
CVE-2026-33494: Ory Oathkeeper has a path traversal authorization bypass. Affects github.com/ory/oathkeeper versions < 0.40.10-0.20260320084758-8e0002140491. Fixed in 0.40.10-0.20260320084758-8e0002140491. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Oathkeeper is an open-source identity and access proxy that enables secure access to APIs and microservices. It acts as a gatekeeper, enforcing access policies for incoming requests. Ory Oathkeeper is designed to handle complex authorization scenarios, making it a critical component in modern cloud-native applications. However, it is vulnerable to a path traversal authorization bypass, which can lead to unauthorized access to sensitive resources.
Vulnerability Detail
Ory Oathkeeper is susceptible to an authorization bypass due to improper handling of HTTP path traversal. An attacker can exploit this vulnerability by crafting a URL that includes path traversal sequences, such as '/public/../admin/secrets'. This request is matched against a permissive rule that allows unauthenticated access, thus bypassing the required authentication for accessing protected resources. The vulnerability arises because the raw, un-normalized path is used for rule evaluation, allowing unauthorized access to sensitive data.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.10-0.20260320084758-8e0002140491
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.40.10-0.20260320084758-8e0002140491Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, ensure that all requests reaching Ory Oathkeeper are normalized. This can be achieved by implementing path normalization in the layers in front of Oathkeeper. For example, in Nginx, use the following configuration:
location / {
proxy_pass http://backend;
# Use $uri instead of $request_uri for normalization
rewrite ^(.*)$ $uri break;
}
Conclusion
The Ory Oathkeeper path traversal authorization bypass vulnerability (CVE-2026-33494) poses a significant risk to applications relying on this package for access control. It is crucial to upgrade to the patched version to mitigate the risk and ensure the security of sensitive resources.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access to sensitive resources, potentially compromising the security of the application and its data.
Yes, you can implement path normalization in front of Oathkeeper using reverse proxies like Nginx or Envoy as a temporary measure.
If immediate upgrading is not possible, ensure that all incoming requests are normalized to prevent exploitation of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
