CVE-2026-33496: Ory Oathkeeper Authentication Bypass Due to Cache Key Confusion
Summary
CVE-2026-33496: Ory Oathkeeper has an authentication bypass by cache key confusion. Affects github.com/ory/oathkeeper versions < 0.40.10-0.20260320084801-198a2bc82a99. Fixed in 0.40.10-0.20260320084801-198a2bc82a99. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ory Oathkeeper is an open-source identity and access proxy that enables secure access to APIs and microservices. It provides various authentication mechanisms, including OAuth2, to ensure that only authorized users can access protected resources. However, it has been found to be vulnerable to an authentication bypass due to cache key confusion, particularly when configured with multiple OAuth2 introspection servers.
Vulnerability Detail
The vulnerability arises from the oauth2_introspection authenticator cache not distinguishing between tokens validated with different introspection URLs. This allows an attacker to use a valid token to prime the cache and subsequently exploit it by using the same token for rules that rely on a different introspection server. The implications of this vulnerability are significant, as it can lead to unauthorized access to sensitive resources, compromising the security of the application.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.10-0.20260320084801-198a2bc82a99
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.40.10-0.20260320084801-198a2bc82a99Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, disable caching for oauth2_introspection authenticators to mitigate the risk. This can be done by modifying the configuration to set caching to false for the relevant authenticators.
Conclusion
In summary, the vulnerability CVE-2026-33496 in Ory Oathkeeper allows for authentication bypass due to cache key confusion. It is crucial to update to the patched version to mitigate this risk or disable caching as a temporary measure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can be exploited if Ory Oathkeeper is configured with multiple oauth2_introspection authenticator servers and caching is enabled.
If you cannot update immediately, disable caching for oauth2_introspection authenticators as a temporary workaround.
You can find more information about Ory Oathkeeper and its features on the official documentation site at https://www.ory.com/docs/oathkeeper.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
