HIGH8.1Go
GHSA-4mq7-pvjg-xp2r· CVE-2026-33496, GO-2026-4799Ory Oathkeeper has an authentication bypass by cache key confusion
Modified: 3/27/2026
package
Go/github.com/ory/oathkeeper
pkg:go/github.com/ory/oathkeeper
CRITICAL10.0Go
GHSA-p224-6x5r-fjpm· CVE-2026-33494, GO-2026-4804Ory Oathkeeper has a path traversal authorization bypass
Modified: 3/27/2026
HIGH7.5Go
GHSA-qvp4-rpmr-xwrr· CVE-2021-32701, GHSA-vfvf-6gx5-mqv6Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
Modified: 9/10/2026
HIGH7.5Go
GHSA-vfvf-6gx5-mqv6· CVE-2021-32701, GHSA-qvp4-rpmr-xwrrIncorrect Authorization in ORY Oathkeeper
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-vhr5-ggp3-qq85· CVE-2026-33495, GO-2026-4810Ory Oathkeeper has an authentication bypass by usage of untrusted header
Modified: 3/27/2026
LOWGo
GHSA-w9mr-28mw-j8hg· GO-2023-1747Hop-by-hop abuse to malform header mutator
Modified: 8/20/2024
—Go
GO-2022-0406· GHSA-qvp4-rpmr-xwrrPossible bypass of token claim validation when OAuth2 Introspection caching is enabled in github.com/ory/oathkeeper
Modified: 3/13/2026
—Go
GO-2022-0920Incorrect Authorization in ORY Oathkeeper in github.com/ory/oathkeeper
Modified: 7/8/2026
—Go
GO-2023-1747· GHSA-w9mr-28mw-j8hgHop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper
Modified: 3/3/2026
—Go
GO-2026-4799· CVE-2026-33496, GHSA-4mq7-pvjg-xp2rOry Oathkeeper has an authentication bypass by cache key confusion in github.com/ory/oathkeeper
Modified: 3/23/2026
—Go
GO-2026-4804· CVE-2026-33494, GHSA-p224-6x5r-fjpmOry Oathkeeper has a path traversal authorization bypass in github.com/ory/oathkeeper
Modified: 3/23/2026
—Go
GO-2026-4810· CVE-2026-33495, GHSA-vhr5-ggp3-qq85Ory Oathkeeper has an authentication bypass by usage of untrusted header in github.com/ory/oathkeeper
Modified: 3/23/2026