CVE-2021-32701: Incorrect Authorization in ORY Oathkeeper
Summary
CVE-2021-32701: Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper. Affects github.com/ory/oathkeeper versions >= 0.38.0-beta.2, < 0.38.12-beta.1. Fixed in 0.38.12-beta.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ORY Oathkeeper is a Go package that provides an authentication and authorization proxy for APIs. It acts as a reverse proxy, intercepting requests and enforcing access control policies. The package is widely used in Go applications to secure API endpoints and manage authentication and authorization workflows. However, a vulnerability has been discovered in the package that allows incorrect authorization, potentially leading to unauthorized access to protected resources.
Vulnerability Detail
The vulnerability in ORY Oathkeeper arises from a flaw in the authorization mechanism. Due to this flaw, the package may incorrectly authorize requests, granting access to protected resources to unauthorized users. This can result in a breach of confidentiality, integrity, and availability of sensitive data or functionality. The vulnerability affects versions 0.38.0-beta.2 to 0.38.12-beta.1 of the package.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.38.12-beta.1
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.38.12-beta.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
ORY Oathkeeper versions 0.38.0-beta.2 to 0.38.12-beta.1 are affected by an incorrect authorization vulnerability. Users should upgrade to version 0.38.12-beta.1 or later to mitigate the risk of unauthorized access to protected resources.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
ORY Oathkeeper is a Go package that provides an authentication and authorization proxy for APIs. It helps secure API endpoints and manage authentication and authorization workflows.
The vulnerability allows incorrect authorization, potentially granting unauthorized access to protected resources. This can lead to a breach of sensitive data or functionality.
Versions 0.38.0-beta.2 to 0.38.12-beta.1 of ORY Oathkeeper are affected by this vulnerability.
To fix the vulnerability, upgrade to version 0.38.12-beta.1 or later of ORY Oathkeeper by updating the package import statement in your application code and fetching the latest version using the package manager.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
