The vulnerability arises from an interpretation conflict in HTTP header normalization in openshift/oauth-proxy. The proxy sets authenticated identity headers only with dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, enabling an authenticated low-privilege user to inject a forged identity header that can override the legitimate authenticated identity in the upstream application. This flaw can lead to identity impersonation attacks. Red Hat has acknowledged the issue and advises upstream application hardening by validating the X-Forwarded-User header against the expected session identity and rejecting mismatched requests. A security update is available in OpenShift Container Platform 4.21.28 and later.

An authenticated low-privilege user can exploit this vulnerability to smuggle a forged identity header that overrides the legitimate authenticated identity in upstream applications using WSGI or PHP frameworks. This can lead to identity impersonation, potentially granting unauthorized access or privileges. The confidentiality impact is high, integrity impact is low, and availability is unaffected. The vulnerability requires network access and low privileges, with no user interaction needed.

Red Hat advises hardening upstream applications by validating the X-Forwarded-User header against the expected authenticated session identity and rejecting requests where these do not match. Additionally, Red Hat has released a security update in OpenShift Container Platform 4.21.28 that addresses this issue. Users should upgrade to this or later versions to apply the official fix. Patch status for version 4.20 is not explicitly stated; check Red Hat advisories for updates. No indication that the vulnerability is mitigated without action.