CVE catalog

CVE-2026-46579

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows

[CVE catalog]

Severity: High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Apr 17, 2026, 8:10:23 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.45% · Oct 25, 2026

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities. openshift/router: openshift/router: mTLS client certificate spoofing via unstripped X-SSL-Client headers on HTTP frontend The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	openshift_container_platform	Not reported	Not reported	unknown
Cpe	openshift_router	Not reported	Not reported	unknown
Cpe	openshift_container_platform	Not reported	Not reported	unknown
Cpe	openshift_router	Not reported	Not reported	unknown

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed: Oct 23, 2026, 9:49:35 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]