CVE-2026-33494 - Vulnerability Analysis

Overview

ORY Oathkeeper < 26.2.0 contains an authorization bypass caused by HTTP path traversal in URL path normalization, letting attackers bypass access control by crafting path traversal sequences, exploit requires crafted URL.

Severity & Score

Impact

Attackers can bypass authorization and access protected resources, potentially exposing sensitive data or functionality.

Mitigation

Upgrade to version 26.2.0 or later.

References

• https://github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2
• https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 26, 2026

🔴 CVE-2026-33494 - Critical (10) ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33494/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner