Weakness (CWE)
CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
How to prevent it (2 mitigations)
-
Architecture and Design
Enforce the use of strong mutual authentication mechanism between the two parties.
-
Architecture and Design
Whenever a product is an intermediary or proxy for
transactions between two other components, the proxy core
should not drop the identity of the initiator of the
transaction. The immutability of the identity of the
initiator must be maintained and should be forwarded all the
way to the target.
Source: MITRE CWE-441
244 results · Feed
-
High 8.8
Confused deputy in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin polic…
-
High 8.8
Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system ac…
-
High 7.7
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets R…
-
High 7.7
Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a Deployment and uses it…
-
Medium 5.1
Angular DevTools (Local DoS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages fr…
-
Medium 6.5
Windows Broadcast DVR User Service Information Disclosure Vulnerability
Improper authorization in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
-
High 7.8
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
-
Medium 6.3
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to th…
-
High 8.1
ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie
ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around…
-
Critical 9.3
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through package…
-
Medium 6.5
Authentication Bypass by Spoofing in Malcolm
Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the location (t…
-
Critical 9.4
AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, cross-host request replay updates the current request but leaves the target request and related p…
-
High 7.5
AsyncHttpClient: Origin credentials sent in cleartext to a proxy that rejects the CONNECT
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rat…
-
Critical 10.0CVE-2026-102255 Public exploit
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alter…
-
Low 3.5
Backstage: Unsupported catalog cluster authentication mode in kubernetes backend
Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affected by unsupported catalog cluster authentication mode in kubernetes backend. Deployments using catalog cluster discovery…
-
Medium 6.4
Backstage: Scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integra…
-
Critical 9.8
Gitea fork workflow approval bypass through maintainer-triggered events
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run …
-
High 8.3
Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging s…
-
Medium 5.4
Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system …
-
Medium 4.3
Confused deputy in DeviceBoundSessionCredentials in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to b…
-
High 8.1
Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
High 8.3
Confused deputy in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised th…
-
Medium 6.1
Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass sys…
-
Medium 4.4
Confused deputy in UI in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass system a…
-
Medium 6.5
Confused deputy in Contextual Tasks in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
Medium 6.5
Confused deputy in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin polic…
-
High 7.8
In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of pri…
-
High 7.8
In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead …
-
Medium 6.0
BuildKit improperly handles special files in build snapshots
BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.
-
Critical 9.3CVE-2026-103922 Public exploit
Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates …
-
Medium 6.5
Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging soc…
-
Medium 4.3
Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social enginee…
-
High 7.0
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
Axios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response.…
-
High 7.6
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a…
-
High 7.3
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-p…
-
Critical 9.9
kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can…
-
High 7.1
Capgo Build Upload Proxy Authorization Bypass via TUS Resource
Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller against a single build job identified by the supplied builder_job_id and validates only that job's stored upload_path, but …
-
High 7.2
Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send re…
-
High 7.4
MCP Atlassian: MCP HTTP Client Server-Local File Exfiltration via Unvalidated Attachment Upload Path
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled At…
-
High 8.6
MCP Atlassian: Arbitrary File Read & Exfiltration (Confused Deputy) in JIRA update_issue
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the Jira update_issue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace…