CVE-2026-46579: Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend
A flaw was found in the OpenShift Router. When a Route has insecureEdgeTerminationPolicy set to Allow, the HTTP frontend does not remove X-SSL-Client- headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted X-SSL-Client- headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Other sources
The OpenShift Router's HAProxy configuration template sets X-SSL-Client- headers (DN, DER, NotAfter, NotBefore, SHA1, Subject) on the HTTPS frontends (fesni, fenosni) using values from the actual TLS handshake. However, the HTTP frontend (fehttp) does not strip these headers from incoming requests. When a Route has insecureEdgeTerminationPolicy set to Allow, an attacker can send plain HTTP requests with forged X-SSL-Client- headers that are forwarded to the backend unmodified. Backends that rely on these headers for mutual TLS authentication can be completely bypassed, allowing an unauthenticated attacker to impersonate any client certificate identity.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set Route insecureEdgeTerminationPolicy to a value other than Allow so the HTTP frontend removes/disallows forwarding of incoming X-SSL-Client-* headers for mutual TLS authentication.
OpenShift Router (HAProxy HTTPS frontend fe_sni / fe_no_sni) insecureEdgeTerminationPolicy = Not Allow - Configuration
Ensure the HTTP frontend (fe_http) strips/removes the X-SSL-Client-* headers (DN, DER, NotAfter, NotBefore, SHA1, Subject) from incoming plain HTTP requests before forwarding them to backends.
OpenShift Router (HTTP frontend fe_http) Header stripping for X-SSL-Client-* = Strip/remove
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46579?
The severity of CVE-2026-46579 is rated high at 7.4.
How do I fix CVE-2026-46579?
To fix CVE-2026-46579, ensure that the 'insecureEdgeTerminationPolicy' is not set to Allow for routes and properly validate incoming headers.
What are the potential risks associated with CVE-2026-46579?
The risks associated with CVE-2026-46579 include allowing unauthenticated attacks through spoofed client certificates, potentially compromising security.
Who is affected by CVE-2026-46579?
Organizations using the Red Hat OpenShift Router with the insecureEdgeTerminationPolicy set to Allow are affected by CVE-2026-46579.
How can I identify if my system is vulnerable to CVE-2026-46579?
To identify if your system is vulnerable to CVE-2026-46579, check the configuration of OpenShift Router for the insecureEdgeTerminationPolicy setting and monitor incoming requests for unstripped headers.