CVE-2026-33494 Ory Oathkeeper has a path traversal authorization bypass

What is CVE-2026-33494?

CVE-2026-33494 is a critical path traversal vulnerability in ory oathkeeper, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. `/public/../admin/secrets`) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation. Version 26.2.0 contains a patch.

Weakness: CWE-23

Which versions are affected by CVE-2026-33494?

3 open source packages ship an affected version, including github.com/ory/oathkeeper. It affects 1 product.

Products include Ory Oathkeeper.

How do I fix CVE-2026-33494?

Upgrade github.com/ory/oathkeeper to 0.40.10-0.20260320084758-8e0002140491 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-33494 being exploited?

There is no known exploitation of CVE-2026-33494 in the wild and no public exploit code.

Other vulnerabilities in ory oathkeeper

• CVE-2026-33496 Ory Oathkeeper has an authentication bypass by cache key confusion High 8.1
• CVE-2021-32701 Possible bypass of token claim validation when OAuth2 Introspection caching is enabled High 7.5
• CVE-2026-33495 Ory Oathkeeper has an authentication bypass by usage of untrusted header Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p224-6x5r-fjpm, GO-2026-4804.