CVE Explorer
CVE-2026-33495
ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Ory Oathkeeper is often deployed behind other components like CDNs, WAFs, or reverse proxies. Depending on the setup, another component might forward the request to the Oathkeeper proxy with a different protocol (http vs. https) than the original request. In order to properly match the request against the configured rules, Oathkeeper considers the `X-For
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"product":"oathkeeper","vendor":"ory","versions":[{"status":"affected","version":"< 26.2.0"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:6575e29d54f8877f25620c4074756a1478a49471e8a3547a23e60d26f102cb45 · sha256:64b6476bd0a58a4f… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:6575e29d54f8877f25620c4074756a1478a49471e8a3547a23e60d26f102cb45 · sha256:64b6476bd0a58a4f… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:6575e29d54f8877f25620c4074756a1478a49471e8a3547a23e60d26f102cb45 · sha256:64b6476bd0a58a4f… · /containers/cna/problemTypes/0/descriptions/0
Source references
2 source assertions{"name":"https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5","tags":["x_refsource_MISC"],"url":"https://github.com/ory/oathkeeper/commit/e9acca14a04d246250557550065e4b4576525bd5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6575e29d54f8877f25620c4074756a1478a49471e8a3547a23e60d26f102cb45 · sha256:64b6476bd0a58a4f… · /containers/cna/references/1
{"name":"https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ory/oathkeeper/security/advisories/GHSA-vhr5-ggp3-qq85"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:6575e29d54f8877f25620c4074756a1478a49471e8a3547a23e60d26f102cb45 · sha256:64b6476bd0a58a4f… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.