Description

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.

INFO

Published Date :

2026-03-26T17:23:33.108Z

Last Modified :

2026-03-27T13:58:20.111Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-33494 vulnerability.

Vendors Products
Ory
  • Oathkeeper
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-33494.

URL Resource
https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2 cve-icon cve-icon
https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact