Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-40575: OAuth2 Proxy can skip login for attackers
CVE-2026-40575 · published 2 months ago
Summary
When OAuth2 Proxy runs with its default settings, it trusts any client as a reverse proxy and accepts the X-Forwarded-Uri header. An unauthenticated user can send a fake X-Forwarded-Uri that matches a route marked as safe, causing the proxy to skip the login step while still reaching the protected service. Fix the configuration by specifying the real proxy IPs in the trusted_proxy_ip setting or disabling the use of X-Forwarded-Uri for authentication decisions.
What to do
- Update github.com oauth2-proxy to version 7.15.2.
- Update oauth2-proxy github.com/oauth2-proxy/oauth2-proxy/v7 to version 7.15.2.
- Update oauth2-proxy to version 7.15.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | oauth2-proxy | oauth2-proxy | <= 7.15.4 |
| go | github.com | oauth2-proxy |
>= 7.5.0, < 7.15.2 Fix: upgrade to 7.15.2
|
| Go | oauth2-proxy | github.com/oauth2-proxy/oauth2-proxy/v7 |
>= 7.5.0, < 7.15.2 Fix: upgrade to 7.15.2
|
| Bitnami | – | oauth2-proxy |
>= 7.5.0, < 7.15.2 >= 7.15.2, <= 7.15.4 Fix: upgrade to 7.15.2
|
| Go | oauth2-proxy | github.com/oauth2-proxy/oauth2-proxy | All versions |
Original advisory text
OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
References
- https://github.com/advisories/GHSA-7x63-xv5r-3p2x
- https://nvd.nist.gov/vuln/detail/CVE-2026-40575 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-40575 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2460449 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40575... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76835... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76835 URL
- https://github.com/oauth2-proxy/oauth2-proxy
- https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-...
- https://www.vulncheck.com/advisories/oauth2-proxy-through-authentication-bypass-...
- https://github.com/oauth2-proxy/oauth2-proxy/issues/3506
- https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/sc...
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published24 Aug 2026
Updated30 Oct 2026
First seen24 Aug 2026
Track software like this
Free during beta