CVE-2026-33495

CVE-2026-33495 is a medium-severity access rule bypass vulnerability affecting Ory Oathkeeper versions prior to 26.2.0. The Identity & Access Proxy incorrectly honored the `X-Forwarded-Proto` header, even when configured not to, potentially allowing an unauthenticated attacker to bypass distinct HTTP/HTTPS access rules. This could lead to partial loss of confidentiality and integrity, though successful exploitation requires specific Oathkeeper configurations and has low attack complexity. There is no evidence of active exploitation or public exploit code, and community attention is minimal. Organizations should upgrade to version 26.2.0 or later and consider dropping unexpected `X-Forwarded-*` headers at the WAF.