Vulnerability-Lookup

CVE-2026-33494 (GCVE-0-2026-33494)

Vulnerability from cvelistv5 – Published: 2026-03-26 17:23 – Updated: 2026-03-27 13:58

Title

Ory Oathkeeper has a path traversal authorization bypass

Summary

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.

Severity ?

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-23 - Relative Path Traversal

Assigner

GitHub_M

References

URL

Tags

	https://github.com/ory/oathkeeper/security/adviso…	x_refsource_CONFIRM
	https://github.com/ory/oathkeeper/commit/8e000214…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	ory	oathkeeper	Affected: < 26.2.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33494",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T13:48:19.576363Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T13:58:20.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oathkeeper",
          "vendor": "ory",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 26.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ORY Oathkeeper is an Identity \u0026 Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T17:29:04.053Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm"
        },
        {
          "name": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2"
        }
      ],
      "source": {
        "advisory": "GHSA-p224-6x5r-fjpm",
        "discovery": "UNKNOWN"
      },
      "title": "Ory Oathkeeper has a path traversal authorization bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33494",
    "datePublished": "2026-03-26T17:23:33.108Z",
    "dateReserved": "2026-03-20T16:59:08.887Z",
    "dateUpdated": "2026-03-27T13:58:20.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33494\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-26T18:16:30.400\",\"lastModified\":\"2026-04-07T21:15:14.387\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ORY Oathkeeper is an Identity \u0026 Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.\"},{\"lang\":\"es\",\"value\":\"ORY Oathkeeper es un proxy de identidad y acceso (IAP) y una API de decisi\u00f3n de control de acceso que autoriza solicitudes HTTP bas\u00e1ndose en conjuntos de reglas de acceso. Las versiones anteriores a la 26.2.0 son vulnerables a una omisi\u00f3n de autorizaci\u00f3n a trav\u00e9s de un salto de ruta HTTP. Un atacante puede crear una URL que contenga secuencias de salto de ruta (por ejemplo, \u0027/public/../admin/secrets\u0027) que se resuelva en una ruta protegida despu\u00e9s de la normalizaci\u00f3n, pero que se compare con una regla permisiva porque la ruta sin procesar y sin normalizar se utiliza durante la evaluaci\u00f3n de la regla. La versi\u00f3n 26.2.0 contiene un parche.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":5.8}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-23\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"26.2.0\",\"matchCriteriaId\":\"657854A7-D847-40E5-9771-601F5BF0FDA4\"}]}]}],\"references\":[{\"url\":\"https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33494\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-27T13:48:19.576363Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-27T13:48:28.470Z\"}}], \"cna\": {\"title\": \"Ory Oathkeeper has a path traversal authorization bypass\", \"source\": {\"advisory\": \"GHSA-p224-6x5r-fjpm\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"ory\", \"product\": \"oathkeeper\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 26.2.0\"}]}], \"references\": [{\"url\": \"https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm\", \"name\": \"https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2\", \"name\": \"https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ORY Oathkeeper is an Identity \u0026 Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-23\", \"description\": \"CWE-23: Relative Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-26T17:29:04.053Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33494\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-27T13:58:20.111Z\", \"dateReserved\": \"2026-03-20T16:59:08.887Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-26T17:23:33.108Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-P224-6X5R-FJPM

Vulnerability from github – Published: 2026-03-20 20:51 – Updated: 2026-03-27 20:59

Summary

Ory Oathkeeper has a path traversal authorization bypass

Details

Description

Ory Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. /public/../admin/secrets) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation.

Preconditions

Ory Oathkeeper rules are typically configured with patterns like:

/public/<.*>   → allow unauthenticated access
/admin/<.*>    → require authentication

Without path normalization, a request to /public/../admin/secrets is matched against the raw path /public/../admin/secrets. This matches the /public/<.*> rule, bypassing the authentication required for /admin/secrets. After Ory Oathkeeper permits the request, the upstream server normalizes the path and serves the protected /admin/secrets resource.

Mitigation

Going forward, Ory Oathkeeper normalizes the request path before performing rule matching and before forwarding. The path /public/../admin/secrets is normalized to /admin/secrets, which correctly matches the /admin/<.*> rule and triggers authentication.

As an immediate mitigation, all requests reaching Oathkeeper should be normalized, as described in the section below. Oathkeeper should be upgraded to a fixed version as soon as possible.

Defense in depth: Cleaning paths before Oathkeeper

Even after this fix, it is good practice to normalize HTTP paths in the layers in front of Oathkeeper. This provides defense in depth and protects against similar bypasses in other components. The following examples show how to achieve this with common reverse proxies and CDNs.

Nginx

Nginx normalizes paths by default when using proxy_pass. Alternatively, use $uri (which Nginx normalizes) rather than $request_uri in your matching rules.

Envoy

Enable the normalize_path option (available since Envoy 1.14) to normalize the path components before matching and forwarding. See the Envoy docs on path normalization.

Cloudflare

Cloudflare normalizes URLs by default. In the Cloudflare dashboard, ensure Normalize incoming URLs is enabled under Rules → Normalization. See the Cloudflare URL normalization docs.

Severity ?

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/ory/oathkeeper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.40.10-0.20260320084758-8e0002140491"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33494"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T20:51:24Z",
    "nvd_published_at": "2026-03-26T18:16:30Z",
    "severity": "CRITICAL"
  },
  "details": "## Description\n\nOry Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation.\n\n## Preconditions\n\nOry Oathkeeper rules are typically configured with patterns like:\n\n```\n/public/\u003c.*\u003e   \u2192 allow unauthenticated access\n/admin/\u003c.*\u003e    \u2192 require authentication\n```\n\nWithout path normalization, a request to `/public/../admin/secrets` is matched against the raw path `/public/../admin/secrets`. This matches the `/public/\u003c.*\u003e` rule, bypassing the authentication required for `/admin/secrets`. After Ory Oathkeeper permits the request, the upstream server normalizes the path and serves the protected `/admin/secrets` resource.\n\n## Mitigation\n\nGoing forward, Ory Oathkeeper normalizes the request path before performing rule matching and before forwarding. The path `/public/../admin/secrets` is normalized to `/admin/secrets`, which correctly matches the `/admin/\u003c.*\u003e` rule and triggers authentication.\n\nAs an immediate mitigation, all requests reaching Oathkeeper should be normalized, as described in the section below. Oathkeeper should be upgraded to a fixed version as soon as possible.\n\n## Defense in depth: Cleaning paths before Oathkeeper\n\nEven after this fix, it is good practice to normalize HTTP paths in the layers in front of Oathkeeper. This provides defense in depth and protects against similar bypasses in other components. The following examples show how to achieve this with common reverse proxies and CDNs.\n\n### Nginx\n\nNginx normalizes paths by default when using `proxy_pass`. Alternatively, use `$uri` (which Nginx normalizes) rather than `$request_uri` in your matching rules.\n\n### Envoy\n\nEnable the `normalize_path` option (available since Envoy 1.14) to normalize the path components before matching and forwarding. See the \u003ca href=\"https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-normalize-path\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eEnvoy docs on path normalization\u003c/a\u003e.\n\n### Cloudflare\n\nCloudflare normalizes URLs by default. In the Cloudflare dashboard, ensure **Normalize incoming URLs** is enabled under **Rules \u2192 Normalization**.\nSee the \u003ca href=\"https://developers.cloudflare.com/rules/normalization/\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eCloudflare URL normalization docs\u003c/a\u003e.",
  "id": "GHSA-p224-6x5r-fjpm",
  "modified": "2026-03-27T20:59:22Z",
  "published": "2026-03-20T20:51:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33494"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ory/oathkeeper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ory Oathkeeper has a path traversal authorization bypass"
}

FKIE_CVE-2026-33494

Vulnerability from fkie_nvd - Published: 2026-03-26 18:16 - Updated: 2026-04-07 21:15

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2	Patch
	security-advisories@github.com	https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	ory	oathkeeper	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "657854A7-D847-40E5-9771-601F5BF0FDA4",
              "versionEndExcluding": "26.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ORY Oathkeeper is an Identity \u0026 Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch."
    },
    {
      "lang": "es",
      "value": "ORY Oathkeeper es un proxy de identidad y acceso (IAP) y una API de decisi\u00f3n de control de acceso que autoriza solicitudes HTTP bas\u00e1ndose en conjuntos de reglas de acceso. Las versiones anteriores a la 26.2.0 son vulnerables a una omisi\u00f3n de autorizaci\u00f3n a trav\u00e9s de un salto de ruta HTTP. Un atacante puede crear una URL que contenga secuencias de salto de ruta (por ejemplo, \u0027/public/../admin/secrets\u0027) que se resuelva en una ruta protegida despu\u00e9s de la normalizaci\u00f3n, pero que se compare con una regla permisiva porque la ruta sin procesar y sin normalizar se utiliza durante la evaluaci\u00f3n de la regla. La versi\u00f3n 26.2.0 contiene un parche."
    }
  ],
  "id": "CVE-2026-33494",
  "lastModified": "2026-04-07T21:15:14.387",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.8,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-26T18:16:30.400",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33494 (GCVE-0-2026-33494)

GHSA-P224-6X5R-FJPM

Description

Preconditions

Mitigation

Defense in depth: Cleaning paths before Oathkeeper

Nginx

Envoy

Cloudflare

FKIE_CVE-2026-33494

Tags

Sightings

Nomenclature