Nginx
CVE-2026-33494
CRITICAL
GHSA-p224-6x5r-fjpm
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionGitHub Advisory
Description
Ory Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. /public/../admin/secrets) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation.
Preconditions
Ory Oathkeeper rules are typically configured with patterns like:
/public/<.*> → allow unauthenticated access
/admin/<.*> → require authenticationWithout path normalization, a request to /public/../admin/secrets is matched against the raw path /public/../admin/secrets. This matches the /public/<.*> rule, bypassing the authentication required for /admin/secrets. After Ory Oathkeeper permits the request, the upstream server normalizes the path and serves the protected /admin/secrets resource.
Mitigation
Going forward, Ory Oathkeeper normalizes the request path before performing rule matching and before forwarding. The path /public/../admin/secrets is normalized to /admin/secrets, which correctly matches the /admin/<.*> rule and triggers authentication.
As an immediate mitigation, all requests reaching Oathkeeper should be normalized, as described in the section below. Oathkeeper should be upgraded to a fixed version as soon as possible.
Defense in depth: Cleaning paths before Oathkeeper
Even after this fix, it is good practice to normalize HTTP paths in the layers in front of Oathkeeper. This provides defense in depth and protects against similar bypasses in other components. The following examples show how to achieve this with common reverse proxies and CDNs.
Nginx
Nginx normalizes paths by default when using proxy_pass. Alternatively, use $uri (which Nginx normalizes) rather than $request_uri in your matching rules.
Envoy
Enable the normalize_path option (available since Envoy 1.14) to normalize the path components before matching and forwarding. See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-normalize-path" target="_blank" rel="noopener noreferrer">Envoy docs on path normalization</a>.
Cloudflare
Cloudflare normalizes URLs by default. In the Cloudflare dashboard, ensure Normalize incoming URLs is enabled under Rules → Normalization. See the <a href="https://developers.cloudflare.com/rules/normalization/" target="_blank" rel="noopener noreferrer">Cloudflare URL normalization docs</a>.
AnalysisAI
Ory Oathkeeper, an identity and access proxy, contains an authorization bypass vulnerability via HTTP path traversal that allows attackers to access protected resources without authentication. The vulnerability affects Ory Oathkeeper installations where the software uses un-normalized paths for rule matching, enabling requests like '/public/../admin/secrets' to bypass authentication requirements. With a CVSS score of 10.0 (Critical) and network-based exploitation requiring no privileges or user interaction, this represents a severe authentication bypass, though no current EPSS score or KEV listing indicates limited evidence of active exploitation at this time.
Technical ContextAI
Ory Oathkeeper is an identity and access proxy written in Go (pkg:go/github.com_ory_oathkeeper) that sits in front of applications to enforce authentication and authorization policies through pattern-matching rules. This vulnerability stems from CWE-23 (Relative Path Traversal), where the proxy performs rule matching against raw, un-normalized request paths before forwarding to upstream servers. When a request containing path traversal sequences (e.g., '../') arrives, Oathkeeper evaluates it against configured rules using the raw path, potentially matching permissive rules like '/public/<.*>', but the upstream server then normalizes the path (e.g., resolving '/public/../admin/secrets' to '/admin/secrets') and serves protected resources. This disconnect between rule evaluation and actual resource access creates an authorization bypass where the access control decision is made on a different path than what is ultimately served.
RemediationAI
Upgrade Ory Oathkeeper to the patched version containing commit 8e0002140491c592db41fa141dc6ad68f417e2b2 or later, available from the vendor at https://github.com/ory/oathkeeper. As an immediate workaround until patching is possible, implement path normalization in reverse proxies or CDNs positioned in front of Oathkeeper: for Nginx, ensure proxy_pass is used (which normalizes by default) or use the normalized $uri variable instead of $request_uri; for Envoy, enable the normalize_path option in the HTTP connection manager configuration; for Cloudflare, verify that 'Normalize incoming URLs' is enabled under Rules → Normalization in the dashboard. Review and audit Oathkeeper rule configurations to identify potentially vulnerable overlapping path patterns (e.g., permissive rules for /public/ alongside restrictive rules for /admin/) and consider restructuring rules to eliminate ambiguity. Implement defense-in-depth by normalizing paths at multiple layers even after upgrading Oathkeeper.
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows remote attackers to crash worker
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today