Loading story…
ORY disclosed two high-severity vulnerabilities in Oathkeeper that can let attackers bypass access controls in deployments running versions prior to 26.2.0. CVE-2026-33496 is an authentication bypass in the oauth2_introspection authenticator caused by cache key confusion: cached token validation results do not distinguish between different introspection server URLs. In affected environments, an attacker with a valid token for one configured introspection server may be able to have that result reused against another server if caching is enabled and multiple introspection backends accept different tokens.
ORY also fixed CVE-2026-33494, an authorization bypass caused by HTTP path traversal when Oathkeeper evaluates raw, unnormalized request paths against access rules. An attacker can craft requests such as:
/public/../admin/secrets
so the request matches a permissive rule before normalization but reaches a protected resource afterward. Both issues were addressed in Oathkeeper 26.2.0, with ORY recommending upgrades; for CVE-2026-33496, disabling caching for oauth2_introspection authenticators is listed as a workaround where immediate patching is not possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ORY addressed both CVE-2026-33494 and CVE-2026-33496 in Oathkeeper version 26.2.0. The fixes normalize path handling for access-rule evaluation and include the introspection server URL in the cache key; disabling caching was also noted as a workaround for the authentication bypass issue.
A GitHub security advisory disclosed CVE-2026-33496 in ORY Oathkeeper's `oauth2_introspection` authenticator, where cached token validation results failed to distinguish between different introspection server URLs, enabling authentication bypass in certain multi-server configurations. The issue affects versions prior to 26.2.0.
A GitHub security advisory disclosed CVE-2026-33494 affecting ORY Oathkeeper, where raw, un-normalized HTTP paths could be matched against permissive access rules and enable authorization bypass via path traversal. The flaw affects versions prior to 26.2.0.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026
Two high-severity vulnerabilities in OpenClaw exposed paths for authenticated users to gain access beyond their intended roles. **CVE-2026-32042** affects versions before `2026.2.25` and allows an attacker with valid shared gateway authentication to present a self-signed, unpaired device identity and bypass pairing requirements, then self-assign elevated operator scopes including `operator.admin`. The issue is classified as `CWE-863` and effectively turns a trusted but unapproved device identity into a route for privilege escalation. A second flaw, **CVE-2026-32051**, affects OpenClaw versions before `2026.3.1` and allows users with `operator.write` scope to reach owner-only tool surfaces such as gateway and cron through agent runs in scoped-token deployments. The authorization mismatch lets lower-privileged authenticated users perform control-plane actions that should be restricted to owners, creating high risk to confidentiality, integrity, and availability. Advisories for both issues point to fixes and security guidance through GitHub and VulnCheck.
Jun 29, 2026
Keycloak disclosed and patched a high-severity privilege escalation flaw, **CVE-2026-9795**, in its Fine-Grained Admin Permissions v2 (`FGAPv2`) feature after researchers reported that a delegated administrator could bypass missing authorization checks in the admin REST API and add arbitrary realm roles to a client’s scope mapping. That weakness allowed limited administrators to inject elevated roles such as `realm-admin` into tokens later issued to users authenticating through the affected client, creating a path to downstream privilege escalation in deployments running Keycloak `26.2.0` and later with `FGAPv2` enabled. The issue was later listed as fixed in Keycloak release `26.6.4`, alongside several other security bugs including **CVE-2026-9099**, **CVE-2026-9083**, **CVE-2026-9086**, **CVE-2026-9705**, **CVE-2026-9799**, **CVE-2026-9800**, and **CVE-2026-11800**. Red Hat also shipped security updates for its Keycloak `26.4.11` images and operator on OpenShift, addressing a broad set of vulnerabilities across the Admin REST API, Account REST API, OIDC dynamic client registration, UMA authorization, token handling, redirect validation, and scope processing, with impacts ranging from information disclosure and SSRF to account takeover, policy bypass, and denial of service.
Jul 12, 2026