CVE-2026-76835: OAuth2 Proxy 7.15.2 through 7.15.4 Authentication Bypass via X-Forwarded-Uri Under the Default Trusted Proxy Set
OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg/requests/util/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skipauthroutes and skipauthregex allow list against the resulting path. CanTrustForwardedHeaders in pkg/apis/middleware/scope.go grants that trust when the caller's address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0/0 and ::/0, whenever reverse proxy mode is enabled without trustedproxyip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OAuth2 Proxyto a version that resolves this vulnerability.Fixed in 7.15.2 - Upgrade
Upgrade
OAuth2 Proxyto a version that resolves this vulnerability.Fixed in 7.15.4
Event History
Frequently Asked Questions
Which deployments are exposed by the default configuration?
Deployments running OAuth2 Proxy 7.15.2 through 7.15.4 are exposed when reverse proxy mode is enabled and trusted_proxy_ip is not configured. In that case, the default trusted proxy set includes 0.0.0.0/0 and ::/0, so any client is treated as a trusted proxy.
What does an attacker need to exploit this?
An unauthenticated network attacker only needs to send a request to OAuth2 Proxy with a client-supplied X-Forwarded-Uri value that matches a configured skip_auth_routes or skip_auth_regex allow-list entry. The attacker can request a protected upstream path while the spoofed header causes the authentication-skip decision.
What configuration change can reduce exposure if patching is not immediately possible?
Configure trusted_proxy_ip so that it contains only the actual reverse proxy addresses, rather than relying on the default trusted proxy set. This prevents arbitrary clients from being considered trusted for forwarded headers.
How can I determine whether my instance is vulnerable?
Check whether the instance is running version 7.15.2, 7.15.3, or 7.15.4, has reverse proxy mode enabled, lacks a trusted_proxy_ip configuration, and uses skip_auth_routes or skip_auth_regex. Under those conditions, a client-controlled X-Forwarded-Uri can influence the path used for the skip-auth check.