Nginx
CVE-2026-33494
CRITICAL
GHSA-p224-6x5r-fjpm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft URL with path traversal sequences
-
ExploitRequest bypasses rule matching on un-normalized path
-
ExecutionAccess protected admin resource
-
ImpactRetrieve secrets unauthenticated
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | Ory Oathkeeper with authorization rules using path patterns (e.g., /public/<.*> allow, /admin/<.*> require auth) without path normalization. Remote unauthenticated attacker crafts URL with path traversal sequences (/public/../admin/...) to bypass authentication checks. No victim interaction required. |
| Impact | The CVSS 3.1 score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N indicates maximum severity: network-accessible, low complexity, requiring no privileges or user interaction, with scope change and high confidentiality and integrity impact. However, real-world risk assessment requires careful consideration—while the vulnerability is technically severe and easily exploitable once an attacker identifies the misconfiguration, successful exploitation depends on specific preconditions: Oathkeeper must be deployed with overlapping permissive and restrictive rules where path traversal can bridge them, and upstream servers must normalize paths differently than Oathkeeper. The availability of a patch from the vendor (commit 8e0002140491c592db41fa141dc6ad68f417e2b2) and detailed mitigation guidance suggests responsible disclosure. Without EPSS data or KEV listing, and given the specific configuration requirements, this appears to be a critical vulnerability for affected deployments but not yet widely exploited in the wild. Organizations using Oathkeeper with the described rule patterns should prioritize immediate patching, as the attack is highly automatable once the vulnerable configuration is identified. |
| Exploit ScenarioDerived | An attacker identifies a web application protected by Ory Oathkeeper with publicly accessible endpoints under '/public/' and admin functionality under '/admin/' requiring authentication. The attacker crafts a request to '/public/../admin/secrets' which Oathkeeper matches against the permissive '/public/<.*>' rule using the un-normalized path, bypassing authentication. Oathkeeper forwards the request to the upstream server, which normalizes the path to '/admin/secrets' and serves the protected administrative resource, granting the unauthenticated attacker access to sensitive data or administrative functions with no complexity or special prerequisites beyond network access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 20, 2026
Ory Oathkeeper, an identity and access proxy, contains an authorization bypass vulnerability via HTTP path traversal that allows attackers to access protected resources without authentication. The vulnerability affects Ory Oathkeeper installations where the software uses un-normalized paths for rule matching, enabling requests like '/public/../admin/secrets' to bypass authentication requirements. With a CVSS score of 10.0 (Critical) and network-based exploitation requiring no privileges or user interaction, this represents a severe authentication bypass, though no current EPSS score or KEV listing indicates limited evidence of active exploitation at this time.
RemediationAI
Upgrade Ory Oathkeeper to the patched version containing commit 8e0002140491c592db41fa141dc6ad68f417e2b2 or later, available from the vendor at https://github.com/ory/oathkeeper. As an immediate workaround until patching is possible, implement path normalization in reverse proxies or CDNs positioned in front of Oathkeeper: for Nginx, ensure proxy_pass is used (which normalizes by default) or use the normalized $uri variable instead of $request_uri; for Envoy, enable the normalize_path option in the HTTP connection manager configuration; for Cloudflare, verify that 'Normalize incoming URLs' is enabled under Rules → Normalization in the dashboard. Review and audit Oathkeeper rule configurations to identify potentially vulnerable overlapping path patterns (e.g., permissive rules for /public/ alongside restrictive rules for /admin/) and consider restructuring rules to eliminate ambiguity. Implement defense-in-depth by normalizing paths at multiple layers even after upgrading Oathkeeper.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ory Oathkeeper is an identity and access proxy written in Go (pkg:go/github.com_ory_oathkeeper) that sits in front of applications to enforce authentication and authorization policies through pattern-matching rules. This vulnerability stems from CWE-23 (Relative Path Traversal), where the proxy performs rule matching against raw, un-normalized request paths before forwarding to upstream servers. When a request containing path traversal sequences (e.g., '../') arrives, Oathkeeper evaluates it against configured rules using the raw path, potentially matching permissive rules like '/public/<.*>', but the upstream server then normalizes the path (e.g., resolving '/public/../admin/secrets' to '/admin/secrets') and serves protected resources. This disconnect between rule evaluation and actual resource access creates an authorization bypass where the access control decision is made on a different path than what is ultimately served.
Know when Nginx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Description
Ory Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. /public/../admin/secrets) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation.
Preconditions
Ory Oathkeeper rules are typically configured with patterns like:
/public/<.*> → allow unauthenticated access
/admin/<.*> → require authenticationWithout path normalization, a request to /public/../admin/secrets is matched against the raw path /public/../admin/secrets. This matches the /public/<.*> rule, bypassing the authentication required for /admin/secrets. After Ory Oathkeeper permits the request, the upstream server normalizes the path and serves the protected /admin/secrets resource.
Mitigation
Going forward, Ory Oathkeeper normalizes the request path before performing rule matching and before forwarding. The path /public/../admin/secrets is normalized to /admin/secrets, which correctly matches the /admin/<.*> rule and triggers authentication.
As an immediate mitigation, all requests reaching Oathkeeper should be normalized, as described in the section below. Oathkeeper should be upgraded to a fixed version as soon as possible.
Defense in depth: Cleaning paths before Oathkeeper
Even after this fix, it is good practice to normalize HTTP paths in the layers in front of Oathkeeper. This provides defense in depth and protects against similar bypasses in other components. The following examples show how to achieve this with common reverse proxies and CDNs.
Nginx
Nginx normalizes paths by default when using proxy_pass. Alternatively, use $uri (which Nginx normalizes) rather than $request_uri in your matching rules.
Envoy
Enable the normalize_path option (available since Envoy 1.14) to normalize the path components before matching and forwarding. See the <a href="https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-normalize-path" target="_blank" rel="noopener noreferrer">Envoy docs on path normalization</a>.
Cloudflare
Cloudflare normalizes URLs by default. In the Cloudflare dashboard, ensure Normalize incoming URLs is enabled under Rules → Normalization. See the <a href="https://developers.cloudflare.com/rules/normalization/" target="_blank" rel="noopener noreferrer">Cloudflare URL normalization docs</a>.
Executive ViewAI
Ory Oathkeeper installations are vulnerable to complete authentication bypass via path traversal attacks, allowing unauthorized access to protected resources and sensitive data without credentials. This critical vulnerability affects any organization using Oathkeeper as an identity proxy and requires immediate patching to prevent unauthorized access to admin functions, APIs, and confidential information.
Apply vendor patch. If immediate patching is delayed: implement WAF rules to block HTTP requests containing '/../' or similar traversal sequences; enable request path normalization at the reverse proxy/load balancer layer; restrict network access to Oathkeeper to known trusted sources only; enable comprehensive access logging to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Ory Oathkeeper Auth Bypass
View all 2Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cau
A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescap
An issue was discovered on GL.iNet devices before version 4.5.0. Rated critical severity (CVSS 9.8), this vulnerability
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range fi
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Rated critical severity (CVSS 9.8
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Low| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB