{"id":11460,"date":"2026-09-04T18:53:16","date_gmt":"2026-09-04T10:53:16","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-76835"},"modified":"2026-09-04T18:53:16","modified_gmt":"2026-09-04T10:53:16","slug":"cve-2026-76835","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-76835","title":{"rendered":"CVE-2026-76835 [CRITICAL] &#8211; OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a requ"},"content":{"rendered":"<p>OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy configuration. GetRequestURI in pkg\/requests\/util\/util.go prefers that header over the real request URI whenever CanTrustForwardedHeaders returns true, and isAllowedPath in oauthproxy.go matches the skip_auth_routes and skip_auth_regex allow list against the resulting path. CanTrustForwardedHeaders in pkg\/apis\/middleware\/scope.go grants that trust when the caller&#8217;s address is in the trusted proxy set, and buildTrustedProxyNetSet falls back to defaultTrustedProxyIPs, which is 0.0.0.0\/0 and ::\/0, whenever reverse proxy mode is enabled without trusted_proxy_ip configured. Every client is therefore treated as a trusted proxy. An unauthenticated attacker can request a protected upstream path while setting X-Forwarded-Uri to a value matching an allow-listed route, so the skip-auth decision is made against the spoofed value while the upstream receives the protected path unchanged.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OAuth2 Proxy honours a client-supplied X-Forwarded-Uri header when deciding whether a request may skip authentication, because the guard added for CVE-2026-40575 is inert in the default reverse-proxy <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11460","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}