CVE-2026-41059

[CVE catalog]

A flaw was found in OAuth2 Proxy. An unauthenticated attacker can exploit a configuration-dependent authentication bypass by sending a crafted request containing a number sign (#) in the path. This allows the OAuth2 Proxy to incorrectly match a public allowlist rule, leading to the exposure of protected resources from the backend application. This vulnerability can result in unauthorized access to sensitive information. github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass via crafted request path leading to unauthorized access This flaw in OAuth2 Proxy allows an unauthenticated attacker to bypass authentication. Exploitation requires a specific configuration utilizing `skip_auth_routes` or `skip_auth_regex` with broad wildcard patterns, combined with a backend application that interprets the '#' character as a fragment delimiter. Red Hat deployments are only affected if these non-default configurations are in place, potentially exposing protected resources. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Severity

High · CVSS 8.2

Published

Apr 21, 2026, 11:17:46 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.27% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "oauth2_proxy",
      "fixed_version": "7.15.2",
      "applicability_unknown": true
    }
  ]
}