CVE-2026-33494

The vulnerability results from a discrepancy between the access rule matching stage and the URL path normalization stage. An attacker constructs a URL containing path traversal sequences (e.g., `/public/../admin/secrets`), which before normalization matches a permissive rule because the rule evaluation is performed on the raw, non-normalized path. After normalization by the target server, the path resolves to a protected resource, which is allowed through without proper permission verification.

An attacker can bypass access control rules and gain unauthorized access to protected API resources or applications behind the proxy. Depending on the architecture of the protected system, this can lead to disclosure of sensitive data or violation of resource integrity.

Ory Oathkeeper should be updated to version 26.2.0, which contains a patch eliminating the vulnerability. The patch is available in the project repository (commit 8e0002140491c592db41fa141dc6ad68f417e2b2).

Ory Oathkeeper in versions earlier than 26.2.0