CVE-2026-33495: Ory Oathkeeper Authentication Bypass via Untrusted Header
Summary
CVE-2026-33495: Ory Oathkeeper has an authentication bypass by usage of untrusted header. Affects github.com/ory/oathkeeper versions < 0.40.10-0.20260320084810-e9acca14a04d. Fixed in 0.40.10-0.20260320084810-e9acca14a04d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Oathkeeper is an open-source identity and access proxy that enables secure access to APIs and microservices. It is designed to enforce access policies and manage authentication and authorization. Oathkeeper is often deployed behind components like CDNs, WAFs, or reverse proxies, which can affect how it processes incoming requests. This vulnerability arises from the improper handling of the 'X-Forwarded-Proto' header, which can lead to authentication bypass under certain configurations.
Vulnerability Detail
The vulnerability in Ory Oathkeeper stems from its failure to respect the configuration option 'serve.proxy.trust_forwarded_headers'. This option is intended to control whether Oathkeeper should trust headers like 'X-Forwarded-Proto'. When this configuration is set to false, Oathkeeper should not consider these headers, but it does so anyway. This flaw allows an attacker to manipulate the 'X-Forwarded-Proto' header to trigger different access rules, potentially bypassing authentication mechanisms. The preconditions for exploitation include having distinct rules for HTTP and HTTPS requests and the ability to send crafted requests with the manipulated header.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.10-0.20260320084810-e9acca14a04d
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.40.10-0.20260320084810-e9acca14a04dTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to drop any unexpected headers as early as possible when handling requests, preferably in the WAF or reverse proxy layer. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The vulnerability identified as CVE-2026-33495 in Ory Oathkeeper poses a risk of authentication bypass due to improper handling of the 'X-Forwarded-Proto' header. Users are encouraged to upgrade to the fixed version to mitigate this risk and implement workarounds if immediate updates are not feasible.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
The CVSS score for this vulnerability is 6.5, indicating a moderate level of severity.
If exploited, this vulnerability could allow unauthorized access to resources by bypassing authentication checks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate upgrade is not possible, implement the recommended workaround by dropping unexpected headers in your WAF or reverse proxy.
You can find more information about Ory Oathkeeper on its official GitHub repository and documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
