CVE-2026-49332 is a security flaw in the openshift/oauth-proxy component of Red Hat OpenShift Container Platform. The proxy sets authenticated identity headers using only dash-variant keys (e.g., X-Forwarded-User) but fails to strip underscore-variant keys (e.g., X_Forwarded_User) from incoming requests. Since WSGI and PHP frameworks normalize both variants to the same variable, an authenticated low-privilege user can smuggle a forged identity header that overrides the legitimate authenticated identity in the upstream application. This vulnerability is categorized under CWE-436 (Interpretation Conflict). Red Hat has rated the impact as Important and assigned a CVSS v3 base score of 8.5 (high). The issue is fixed in OpenShift Container Platform version 4.21.28.

This vulnerability allows an authenticated low-privilege user to impersonate another user by injecting forged identity headers that override legitimate authenticated identities in upstream WSGI or PHP applications. This can lead to unauthorized access or privilege escalation within the affected OpenShift environment. The confidentiality impact is high, integrity impact is low, and availability is not affected.

Red Hat has released OpenShift Container Platform 4.21.28 containing fixes for this vulnerability. Users should upgrade to version 4.21.28 or later to fully remediate the issue. Additionally, upstream applications should implement hardening by validating the X-Forwarded-User header against the expected session identity and rejecting requests where identity headers do not match the authenticated session. No other vendor advisories indicate alternative mitigations or that no action is required.