CVE-2026-76835

{"id": "CVE-2026-76835", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76835", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T20:00:05.680574Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/oauth2-proxy/oauth2-proxy", "vendor": "oauth2-proxy", "product": "oauth2-proxy", "versions": [{"status": "affected", "version": "7.15.2", "versionType": "semver", "lessThanOrEqual": "7.15.4"}], "packageURL": "pkg:golang/github.com/oauth2-proxy/oauth2-proxy/v7", "defaultStatus": "unaffected"}]}], "published": "2026-08-24T18:17:21.570", "references": [{"url": "https://github.com/oauth2-proxy/oauth2-proxy", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/oauth2-proxy/oauth2-proxy/blob/v7.15.4/pkg/apis/middleware/scope.go", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/oauth2-proxy/oauth2-proxy/issues/3506", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-7x63-xv5r-3p2x", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/oauth2-proxy-through-authentication-bypass-via-x-forwarded-uri-under-the-default-trusted-proxy-set", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/oauth2-proxy/oauth2-proxy/issues/3506", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-290"}]}], "descriptions": [{"lang": "en", "value": "OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged."}, {"lang": "es", "value": "OAuth2 Proxy respeta un encabezado X-Forwarded-Uri proporcionado por el cliente al decidir si una solicitud puede omitir la autenticaci\u00f3n, porque la protecci\u00f3n a\u00f1adida para CVE-2026-40575 es inerte en la configuraci\u00f3n predeterminada de proxy inverso. GetRequestURI en pkg/requests/util/util.go prefiere ese encabezado sobre la URI de solicitud real siempre que CanTrustForwardedHeaders devuelva verdadero, e isAllowedPath en oauthproxy.go compara la lista de permitidos skip_auth_routes y skip_auth_regex con la ruta resultante. CanTrustForwardedHeaders en pkg/apis/middleware/scope.go otorga esa confianza cuando la direcci\u00f3n del llamante est\u00e1 en el conjunto de proxies de confianza, y buildTrustedProxyNetSet recurre a defaultTrustedProxyIPs, que es 0.0.0.0/0 y ::/0, siempre que el modo de proxy inverso est\u00e9 habilitado sin trusted_proxy_ip configurado. Cada cliente es, por lo tanto, tratado como un proxy de confianza. Un atacante no autenticado puede solicitar una ruta ascendente protegida mientras establece X-Forwarded-Uri a un valor que coincide con una ruta permitida, por lo que la decisi\u00f3n de omitir la autenticaci\u00f3n se toma contra el valor falsificado mientras que el sistema ascendente recibe la ruta protegida sin cambios."}], "lastModified": "2026-10-13T09:10:00.323", "sourceIdentifier": "disclosure@vulncheck.com"}