oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header (CVE-2026-405…

Overview

A flaw was found in OAuth2 Proxy. When configured with --reverse-proxy and either --skip-auth-regex or --skip-auth-route, the proxy may trust a client-supplied X-Forwarded-Uri header. An unauthenticated remote attacker can exploit this by spoofing the header, leading to an authentication bypass. This allows unauthorized access to protected routes without a valid session.

Vendor advisories

• RHSA-2026:58471 · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-22 · advisory
• Red Hat VEX · Important · affected: Red Hat Ceph Storage 9 · no fix planned: Red Hat Ceph Storage 9 · updated 2026-09-21 · vex

oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header — rated Important by Red Hat. Released 2026-04-21, updated 2026-09-21.

Affected:

• Red Hat Ceph Storage 9

Fixed:

• Red Hat Hardened Images

No fix planned:

• Red Hat Ceph Storage 9

Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:58471

Workarounds / mitigations:

• This issue can be mitigated by one of the options bellow:

1. Strip any client-provided X-Forwarded-Uri header at any layer before it reaches oauth2-proxy;
2. Overwrite the X-Forwarded-Uri header with the actual request URI before the request reaches oauth2-proxy. If you are using NGINX you can use the following example to create your tailored mitigation:

  location /internal-auth/ {
    internal; # Ensure external users can't access this path

    # Make sure the OAuth2 Proxy know…

## Package advisory (CVE-2026-40575)

Affected packages:

- `github.com/oauth2-proxy/oauth2-proxy/v7 >= 7.5.0, < 7.15.2`

Patched in:

- `github.com/oauth2-proxy/oauth2-proxy/v7 7.15.2`

Source: https://osv.dev/vulnerability/GHSA-7x63-xv5r-3p2x