Github.Com Ory Oathkeeper vulnerabilities

CVE-2026-33494 [CRITICAL] CWE-23 Ory Oathkeeper has a path traversal authorization bypass Ory Oathkeeper has a path traversal authorization bypass ## Description Ory Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evalu

CVE-2026-33496 [HIGH] CWE-1289 Ory Oathkeeper has an authentication bypass by cache key confusion Ory Oathkeeper has an authentication bypass by cache key confusion ## Description Ory Oathkeeper is vulnerable to authentication bypass due to cache key confusion. The `oauth2_introspection` authenticator cache does not distinguish tokens that were validated with different introspection URLs. An attacker can therefore legitimately use a token to prime the cache, and subsequently use the same token

CVE-2021-32701 [HIGH] CWE-863 Incorrect Authorization in ORY Oathkeeper Incorrect Authorization in ORY Oathkeeper ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that

CVE-2026-33495 [MEDIUM] CWE-862 Ory Oathkeeper has an authentication bypass by usage of untrusted header Ory Oathkeeper has an authentication bypass by usage of untrusted header ## Description Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the request to the Oathkeeper proxy with a different protocol (http vs. https) than the original request. In order to properly match the request against th