CVE-2026-41059
Description
A flaw was found in OAuth2 Proxy. An unauthenticated attacker can exploit a configuration-dependent authentication bypass by sending a crafted request containing a number sign (#) in the path. This allows the OAuth2 Proxy to incorrectly match a public allowlist rule, leading to the exposure of protected resources from the backend application. This vulnerability can result in unauthorized access to sensitive information.
Statement
This flaw in OAuth2 Proxy allows an unauthenticated attacker to bypass authentication. Exploitation requires a specific configuration utilizing skip_auth_routes or skip_auth_regex with broad wildcard patterns, combined with a backend application that interprets the '#' character as a fragment delimiter. Red Hat deployments are only affected if these non-default configurations are in place, potentially exposing protected resources.
Mitigation
To mitigate this issue, review and tighten `skip_auth_routes` and `skip_auth_regex` configurations in OAuth2 Proxy, replacing broad wildcard patterns with exact, anchored public paths and explicit HTTP methods. Additionally, consider implementing ingress, load balancer, or Web Application Firewall (WAF) rules to reject requests containing `%23` or '#' in the path. Avoid placing sensitive application paths behind broadly defined `skip_auth_routes` rules. Configuration changes to OAuth2 Proxy may require a service restart to take effect, which could temporarily impact service availability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 8.2 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
