{"id":"CVE-2026-40575","title":"oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header (CVE-2026-405…","summary":"A flaw was found in OAuth2 Proxy. When configured with `--reverse-proxy` and either `--skip-auth-regex` or `--skip-auth-route`, the proxy may trust a client-supplied `X-Forwarded-Uri` header. An unauthenticated remote attacker can exploit …","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvssSource":"vendor","cwe":"CWE-290","vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["ceph_storage 9","hardened_images"],"patched":["hardened_images"],"published":"2026-04-21","updated":"2026-09-21","sourceUpdated":"2026-09-21T16:40:43+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-40575"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460449"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-40575"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40575"},{"url":"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x"},{"url":"https://access.redhat.com/errata/RHSA-2026:58471"},{"url":"https://github.com/oauth2-proxy/oauth2-proxy"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00477,"epssPercentile":0.40244,"aliases":["GHSA-7x63-xv5r-3p2x","BIT-oauth2-proxy-2026-40575","GO-2026-5236"],"ecosystem":"go","scores":{"vendor":8.7,"osv":9.1},"ingestedAt":"2026-07-21T19:04:58.367Z","slug":"CVE-2026-40575","body":"## Overview\n\nA flaw was found in OAuth2 Proxy. When configured with `--reverse-proxy` and either `--skip-auth-regex` or `--skip-auth-route`, the proxy may trust a client-supplied `X-Forwarded-Uri` header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass. This allows unauthorized access to protected routes without a valid session.\n\n## Vendor advisories\n\n- **RHSA-2026:58471** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:58471)\n- **Red Hat VEX** · Important · affected: Red Hat Ceph Storage 9 · no fix planned: Red Hat Ceph Storage 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40575.json)\n\n**oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header** — rated Important by Red Hat. Released 2026-04-21, updated 2026-09-21.\n\nAffected:\n\n- Red Hat Ceph Storage 9\n\nFixed:\n\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Ceph Storage 9\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:58471\n\nWorkarounds / mitigations:\n\n- This issue can be mitigated by one of the options bellow:\n\n1) Strip any client-provided `X-Forwarded-Uri` header at any layer before it reaches `oauth2-proxy`;\n2) Overwrite the `X-Forwarded-Uri` header with the actual request URI before the request reaches `oauth2-proxy`. If you are using NGINX you can use the following example to create your tailored mitigation:\n\n~~~\n  location /internal-auth/ {\n    internal; # Ensure external users can't access this path\n\n    # Make sure the OAuth2 Proxy know…\n\n## Package advisory (CVE-2026-40575)\n\nAffected packages:\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2`\n\nPatched in:\n\n- `github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2`\n\nSource: https://osv.dev/vulnerability/GHSA-7x63-xv5r-3p2x","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":208490,"id":"CVE-2026-40575","ts":1790005719410,"field":"cvss","old":"9.1","new":"8.7"},{"seq":208489,"id":"CVE-2026-40575","ts":1790005719410,"field":"severity","old":"critical","new":"high"}]}