CVE-2026-49332: Red Hat Openshift Container Platform 4.12

High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.

Affected products

Red Hat Red Hat Openshift Container Platform 4.12: before 1786458704 (fixed in 1786458704)
Red Hat Red Hat Openshift Container Platform 4.13: before 1786477436 (fixed in 1786477436)
Red Hat Red Hat Openshift Container Platform 4.14: before 1785549818 (fixed in 1785549818)
Red Hat Red Hat Openshift Container Platform 4.15: before 1787054100 (fixed in 1787054100)
Red Hat Red Hat Openshift Container Platform 4.16: before 1785544039 (fixed in 1785544039)
Red Hat Red Hat Openshift Container Platform 4.17: before 1787543313 (fixed in 1787543313)
Red Hat Red Hat Openshift Container Platform 4.18: before 1785529735 (fixed in 1785529735)
Red Hat Red Hat Openshift Container Platform 4.19: before 1785521728 (fixed in 1785521728)
Red Hat Red Hat Openshift Container Platform 4.20: before 1785833742 (fixed in 1785833742)
Red Hat Red Hat Openshift Container Platform 4.21: before 1785851359 (fixed in 1785851359)
Red Hat Red Hat Openshift Container Platform 4.22: before 1785885351 (fixed in 1785885351)

Published 2026-07-28. Last modified 2026-09-21.