Go/github.com/ory/oathkeeper CVE-2026-33495: medium 6.5, EPSS 0.24%
Ory Oathkeeper has an authentication bypass by usage of untrusted header in github.com/ory/oathkeeper
Action: Upgrade github.com/ory/oathkeeper to 0.40.10-0.20260320084810-e9acca14a04d or later.
go get github.com/ory/oathkeeper@v0.40.10-0.20260320084810-e9acca14a04dAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.40.10-0.20260320084810-e9acca14a04d | - |
Fixed versions
| 0.40.10-0.20260320084810-e9acca14a04d |
Sources
- osv: GO-2026-4810
- nvd: CVE-2026-33495
- https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85
- https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5
CVE-2026-33495 · published · modified · JSON