CVE-2026-33494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33494", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-20T16:59:08.887Z", "datePublished": "2026-03-26T17:23:33.108Z", "dateUpdated": "2026-03-27T13:58:20.111Z"}, "containers": {"cna": {"title": "Ory Oathkeeper has a path traversal authorization bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "lang": "en", "description": "CWE-23: Relative Path Traversal", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm"}, {"name": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2", "tags": ["x_refsource_MISC"], "url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2"}], "affected": [{"vendor": "ory", "product": "oathkeeper", "versions": [{"version": "< 26.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:29:04.053Z"}, "descriptions": [{"lang": "en", "value": "ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch."}], "source": {"advisory": "GHSA-p224-6x5r-fjpm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T13:48:19.576363Z", "id": "CVE-2026-33494", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:58:20.111Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T13:48:19.576363Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T13:48:28.470Z"}}], "cna": {"title": "Ory Oathkeeper has a path traversal authorization bypass", "source": {"advisory": "GHSA-p224-6x5r-fjpm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "ory", "product": "oathkeeper", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "references": [{"url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm", "name": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2", "name": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23: Relative Path Traversal"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-26T17:29:04.053Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33494", "state": "PUBLISHED", "dateUpdated": "2026-03-27T13:58:20.111Z", "dateReserved": "2026-03-20T16:59:08.887Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-26T17:23:33.108Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oathkeeper", "vendor": "ory", "versions": [{"status": "affected", "version": "< 26.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ory:oathkeeper:*:*:*:*:*:*:*:*", "matchCriteriaId": "657854A7-D847-40E5-9771-601F5BF0FDA4", "versionEndExcluding": "26.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch."}, {"lang": "es", "value": "ORY Oathkeeper es un proxy de identidad y acceso (IAP) y una API de decisi\u00f3n de control de acceso que autoriza solicitudes HTTP bas\u00e1ndose en conjuntos de reglas de acceso. Las versiones anteriores a la 26.2.0 son vulnerables a una omisi\u00f3n de autorizaci\u00f3n a trav\u00e9s de un salto de ruta HTTP. Un atacante puede crear una URL que contenga secuencias de salto de ruta (por ejemplo, '/public/../admin/secrets') que se resuelva en una ruta protegida despu\u00e9s de la normalizaci\u00f3n, pero que se compare con una regla permisiva porque la ruta sin procesar y sin normalizar se utiliza durante la evaluaci\u00f3n de la regla. La versi\u00f3n 26.2.0 contiene un parche."}], "id": "CVE-2026-33494", "lastModified": "2026-06-17T10:37:35.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33494", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T13:48:19.576363Z", "version": "2.0.3"}}]}, "published": "2026-03-26T18:16:30.400", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-23"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,26.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "oathkeeper", "source": "cna", "vendor": "ory"}, "product": "oathkeeper", "vendor": "ory"}], "analysis": {"en": {"generated_at": "2026-04-07T23:42:11.338593+00:00", "value": {"mitigation_remediation": ["Upgrade Ory Oathkeeper to version 26.2.0 or later."], "summary": {"action": "Immediate Patch", "impact": "Authorization Bypass via Path Traversal"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Ory Oathkeeper versions prior to 26.2.0. Users running 26.2.0 or later are not affected.", "description_and_impact": "Ory Oathkeeper, an Identity & Access Proxy, fails to normalize URL paths when evaluating access rules. An attacker can send a request such as \"/public/../admin/secrets\"; after normalization the request targets a protected route, but the raw, un-normalized path is used in rule evaluation. The permissive rule matches the raw path, granting the attacker unauthorized access to the protected resource. This enables confidential data exposure and other privileged actions.", "risk_and_exploitability": "The CVSS score is 10, indicating the highest severity, but the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. It can be exploited remotely via crafted HTTP requests and requires no special privileges or local access."}}}}, "created": "2026-03-27T08:33:29.301780+00:00", "updated": "2026-04-08T20:01:13.867107+00:00", "vendors": ["ory", "ory$PRODUCT$oathkeeper"]}