RHSA-2026:58471HighCVSS 8.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
August 22, 2026
Last Modified
September 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-40575 →

📋 Description

CVE-2026-40575 — oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header

🎯 Affected products4

  • Red Hat Hardened Images
  • oauth2-proxy-0:7.15.4-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • oauth2-proxy-0:7.15.4-0.1.hum1@src as a component of Red Hat Hardened Images
  • oauth2-proxy-0:7.15.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: This issue can be mitigated by one of the options bellow: 1) Strip any client-provided `X-Forwarded-Uri` header at any layer before it reaches `oauth2-proxy`; 2) Overwrite the `X-Forwarded-Uri` header with the actual request URI before the request reaches `oauth2-proxy`. If you are using NGINX you can use the following example to create your tailored mitigation: ~~~ location /internal-auth/ { internal; # Ensure external users can't access this path # Make sure the OAuth2 Proxy knows where the original request came from. proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; # set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri proxy_set_header X-Forwarded-Uri $request_uri; proxy_pass http://oauth2-proxy:4180/; } ~~~ 3) Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy; 4) Remove or narrow --skip-auth-route / --skip-auth-regex rules where possible;

🔗 References (5)