The vulnerability arises from openshift/oauth-proxy setting authenticated identity headers with dash-variant keys (e.g., X-Forwarded-User) but failing to strip underscore-variant keys (e.g., X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same internal variable, which can be exploited by an authenticated low-privilege user to smuggle a forged identity header. This may allow the attacker to override the legitimate authenticated identity in the upstream application, potentially leading to privilege escalation or unauthorized access. The issue is tracked as CWE-436 (Interpretation Conflict). Red Hat has issued security advisories RHSA-2026:51007 and RHSA-2026:51013 providing updated container images and packages for OpenShift Container Platform 4.18.52 and 4.19.42, respectively, which fix this vulnerability.

An authenticated low-privilege user can exploit this vulnerability to forge an identity header that overrides the legitimate authenticated identity in upstream applications. This can lead to unauthorized access or privilege escalation within the affected OpenShift Container Platform environment. The CVSS v3.1 base score is 8.5 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

Red Hat has released official fixes for this vulnerability in OpenShift Container Platform versions 4.18.52 and 4.19.42. Users should upgrade their clusters to these versions or later to fully mitigate the issue. Instructions for upgrading are available in the Red Hat OpenShift documentation. No additional mitigations are specified beyond applying these updates.