oathkeeper vulnerabilities

2 known vulnerabilities in oathkeeper from Ory. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  oathkeeper: Authentication Bypass by Primary Weakness

  CVE-2026-33496Mar 26, 2026Ory

  ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to authentication bypass due to cache key confusion. The `oauth2_introspecti

• 10.0 Critical severity

  oathkeeper: Relative Path Traversal

  CVE-2026-33494Mar 26, 2026Ory

  ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a