EUVD-2026-33274
GHSA-ccmj-8c3p-4qwj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Route with insecureEdgeTerminationPolicy Allow
-
DeliverySend HTTP request with forged X-SSL-Client-* headers
-
ExploitRouter forwards headers unsanitized to backend
-
ExecutionBackend trusts headers as mTLS identity
-
ImpactAttacker acts as impersonated certificate subject
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a Route on OpenShift Container Platform 4 configured with spec.tls.insecureEdgeTerminationPolicy=Allow (a non-default opt-in setting that permits HTTP alongside edge-terminated HTTPS) AND a backend application behind that Route that consumes X-SSL-Client-Cert, X-SSL-Client-DN, or X-SSL-Client-Verify headers as authoritative mTLS identity. The attacker needs only network reachability to the Route's HTTP listener with no credentials or user interaction. Limiting factors: Routes using Redirect or None/disable edge termination policies, passthrough/reencrypt termination, or backends that perform their own certificate validation are not exploitable; impact is also bounded to integrity of the identity claim, with no direct confidentiality or availability effect at the router layer. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 High) is internally consistent with the description: network-reachable, no authentication, no user interaction, and an integrity-only impact reflecting identity spoofing rather than data disclosure or DoS. However the SSVC signals tell a more nuanced story - Exploitation:none and Automatable:no with EPSS at 0.03% (9th percentile) and no CISA KEV listing indicate this is not currently a mass-exploited issue, while Technical Impact:total acknowledges that a successful spoof can fully subvert an application's mTLS identity model. Real-world risk is therefore highly conditional on a customer specifically deploying Routes with insecureEdgeTerminationPolicy=Allow AND running backends that trust X-SSL-Client-* headers for authentication; environments using redirect or disable policies, or backends that re-validate certificates independently, are not exposed. The CVSS-derived urgency is materially higher than the exploitation-likelihood signals suggest, so this should be treated as a configuration-dependent integrity issue to remediate during a normal patch cycle, with priority elevated for clusters that knowingly use header-based mTLS propagation. |
| Exploit ScenarioDerived | An attacker on the Internet sends a plain HTTP request to a vulnerable OpenShift Route with insecureEdgeTerminationPolicy=Allow, injecting headers such as X-SSL-Client-DN: CN=admin,O=Corp and X-SSL-Client-Verify: SUCCESS. The router forwards the request unchanged to a backend that treats those headers as proof of mTLS authentication, granting the attacker the impersonated identity's privileges in the application. No public exploit identified at time of analysis, but the attack is trivially scriptable with curl given AC:L/PR:N/UI:N. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 23, 2026
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows remote unauthenticated attackers to impersonate TLS client certificate identities by injecting X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip these trusted headers from inbound requests. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC marks exploitation status as none with total technical impact.
Earlier versions of this analysis (2)
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows unauthenticated remote attackers to impersonate mTLS client certificate identities by injecting X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip attacker-controlled SSL client headers before forwarding to backends. No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.03%), but SSVC classifies technical impact as total.
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows unauthenticated remote attackers to impersonate client certificate identities by injecting forged X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip these trusted headers from incoming requests, enabling mTLS-based backend authentication to be subverted. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - apply the OpenShift updates published in RHSA-2026:27044 and RHSA-2026:27063 (linked from https://access.redhat.com/security/cve/CVE-2026-46579) for your specific OCP 4 minor stream, since exact patched router versions are not enumerated in the provided data. As a compensating control until patching, change any Route using spec.tls.insecureEdgeTerminationPolicy=Allow to either Redirect (forces HTTPS, transparent for most clients) or None/disable (rejects HTTP, may break clients that intentionally hit port 80); both close the bypass but the Redirect option preserves availability for HTTP clients. Where the Allow policy must remain, add an HAProxy or upstream filter that explicitly strips X-SSL-Client-Cert, X-SSL-Client-DN, X-SSL-Client-Verify, and related headers on the HTTP listener, and audit backend applications to require certificate re-validation or to consume mTLS identity only from headers that the router has been verified to set itself, accepting the operational cost of additional config drift.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The OpenShift Router is the HAProxy-based ingress component that terminates TLS and forwards traffic to backend pods in OpenShift Container Platform 4. When a Route uses edge TLS termination with insecureEdgeTerminationPolicy=Allow, the router accepts plain HTTP on the same Route and is expected to sanitize identity-bearing headers like X-SSL-Client-Cert, X-SSL-Client-DN, and X-SSL-Client-Verify before proxying upstream. The CWE-287 (Improper Authentication) root cause is missing header sanitization on the HTTP listener: backends that consume these headers as proof of mTLS authentication will trust attacker-supplied values. Affected CPE strings point exclusively to red_hat:red_hat_openshift_container_platform_4, and the issue is tracked in Red Hat Bugzilla 2483181 with errata RHSA-2026:27044 and RHSA-2026:27063.
Know when Red Hat Openshift Container Platform 4 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-reachable HTTP listener, no auth or interaction; integrity-only impact via spoofed identity headers, no confidentiality or availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
A flaw was found in the OpenShift Router. When a Route has insecureEdgeTerminationPolicy set to Allow, the HTTP frontend does not remove X-SSL-Client-* headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted X-SSL-Client-* headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Executive ViewAI
A critical authentication bypass in Red Hat OpenShift Container Platform 4 Router allows unauthenticated attackers to forge client certificate identities and bypass authorization controls. Organizations running OpenShift with insecureEdgeTerminationPolicy=Allow settings are at risk of unauthorized access to containerized applications and APIs. No public exploit identified at time of analysis, but the vulnerability directly circumvents identity verification mechanisms and requires immediate action to prevent credential spoofing.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Immediately change insecureEdgeTerminationPolicy from Allow to Redirect or Reencrypt on all affected Routes; (2) Implement network-layer access controls restricting plain HTTP traffic to Router frontends to authenticated internal networks only; (3) Deploy monitoring and alerting for X-SSL-Client-* headers in inbound HTTP requests; (4) Validate that downstream applications enforce independent client certificate verification rather than trusting Router-forwarded identity headers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)NVD
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Privilege escalation in Red Hat Advanced Cluster Management's multicloud-operators-subscription controller lets a low-pr
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an
Unauthenticated path traversal in gvproxy, the network forwarder shipped in the gvisor-tap-vsock package (used by Podman
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Symlink-following file overwrite on the Ansible control node is possible in ansible-core when a user runs `ansible-galax
A use-after-free race condition in QEMU's 9pfs (virtfs) passthrough subsystem allows a malicious guest user to escape th
Exploit-DB