The vulnerability in openshift/oauth-proxy (CVE-2026-49332) arises from improper handling of HTTP headers used for authenticated identity. The proxy sets headers with dash-variant keys (e.g., X-Forwarded-User) but fails to remove underscore-variant keys (e.g., X_Forwarded_User) from incoming requests. Since WSGI and PHP frameworks normalize both variants to the same internal variable, an attacker with low privileges can smuggle a forged identity header to override the legitimate authenticated identity in the upstream application. This is classified under CWE-436 (Improper Handling of Alternative Representations of HTTP Headers). Red Hat has issued security advisories RHSA-2026:51007 and RHSA-2026:51013 providing updated container images and packages for OpenShift Container Platform 4.19.42 and 4.18.52 respectively, which include fixes for this vulnerability.

An authenticated low-privilege user can exploit this vulnerability to impersonate another user by injecting forged identity headers that override the legitimate authenticated identity in upstream applications. This can lead to unauthorized access to sensitive data or functionality. The CVSS 3.1 base score is 8.5 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Red Hat has released official security updates fixing this vulnerability in OpenShift Container Platform versions 4.18.52 and 4.19.42. Users should upgrade their clusters to these versions or later as soon as possible following the vendor's documented upgrade procedures. The vendor manages remediation for these on-premise/private cloud deployments via updated container images and RPM packages. No alternative mitigations are specified in the advisory; applying the official fix is required to address the issue.