점검 대응높음KEV 미등록
CVE-2026-49332
Red Hat Red Hat OpenShift Container Platform 4 취약점
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate authenticated identity in the upstream application.
- 대응 우선순위
- 점검
- CVSS
- 8.5
- EPSS
- 0.19% 백분위 9.32% · 2026.08.02 기준
- CISA KEV
- 미등록
- 조치 기한
- -
- 공개일
- 2026.07.28