Go/github.com/ory/oathkeeper CVE-2026-33496: unknown, EPSS 0.53%
Ory Oathkeeper has an authentication bypass by cache key confusion in github.com/ory/oathkeeper
Action: Upgrade github.com/ory/oathkeeper to 0.40.10-0.20260320084801-198a2bc82a99 or later.
go get github.com/ory/oathkeeper@v0.40.10-0.20260320084801-198a2bc82a99Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.40.10-0.20260320084801-198a2bc82a99 | - |
Fixed versions
| 0.40.10-0.20260320084801-198a2bc82a99 |
Sources
- osv: GO-2026-4799
- https://github.com/ory/oathkeeper/security/advisories/GHSA-4mq7-pvjg-xp2r
- https://github.com/ory/oathkeeper/commit/198a2bc82a99e0a77bd0ffe290cbdd5285a1b17c
CVE-2026-33496 · published · modified · JSON