CVE-2026-49332 is a security flaw in openshift/oauth-proxy where the proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not remove underscore-variant keys (X_Forwarded_User) from incoming requests. Because WSGI and PHP frameworks normalize both variants to the same variable, an authenticated low-privilege user can inject a forged identity header via the underscore variant, potentially overriding the legitimate authenticated identity in the upstream application. This vulnerability is categorized under CWE-436 (Interpretation Conflict). Red Hat has issued OpenShift Container Platform 4.21.28 containing fixes for this issue and other bugs. The vendor rates the security impact as Important with a CVSS v3 base score of 8.5 (Red Hat scoring).

The vulnerability allows an authenticated low-privilege user to impersonate another identity by injecting forged identity headers that override legitimate authenticated identities in upstream WSGI and PHP applications. This can lead to unauthorized access or privilege escalation within the affected OpenShift environment. The impact is rated as high confidentiality impact and low integrity impact with no availability impact. There are no known exploits in the wild at this time.

Red Hat has released OpenShift Container Platform 4.21.28 which includes fixes for this vulnerability. Users should upgrade to this version using the official upgrade instructions provided by Red Hat. Additionally, upstream applications should implement hardening by validating the X-Forwarded-User header against the expected session identity and rejecting requests where identity headers do not match the authenticated session. This mitigates the risk of identity smuggling via underscore-variant headers.