The vulnerability in Red Hat OpenShift Container Platform's OpenShift Router occurs when a Route has insecureEdgeTerminationPolicy set to Allow. The HTTP frontend does not strip X-SSL-Client-* headers from incoming HTTP requests, which are normally used for mutual TLS authentication. This allows an unauthenticated attacker to send crafted HTTP requests with these headers, bypassing backend mutual TLS authentication and impersonating client certificate identities. The issue affects versions >=4.21 <4.21.21 and >=4.22 <4.22.2. Red Hat has issued security advisories RHSA-2026:27044 and RHSA-2026:27009 with updated container images and packages to fix this vulnerability.

Successful exploitation allows an unauthenticated attacker to bypass mutual TLS authentication mechanisms relying on X-SSL-Client-* headers, enabling impersonation of client certificate identities. This compromises confidentiality and integrity of client authentication but does not affect availability. The CVSS v3.1 score is 7.4 (High), reflecting network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.

Red Hat has released fixed versions 4.21.21 and 4.22.2 of OpenShift Container Platform that address this vulnerability. Users should upgrade to these versions as soon as possible using the OpenShift CLI (oc) or web console. Detailed upgrade instructions are available in the Red Hat documentation for OpenShift Container Platform 4.21 and 4.22. No additional mitigations are specified beyond applying the official updates.