Description
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.22 | — | — |
Advisories 1
- WID-SEC-2026-2040 Red Hat OpenShift Container Platform (Router): Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Aug 5, 2026
References
- RHSA-2026:27009 vendor-advisory
- RHSA-2026:27044 vendor-advisory
- RHSA-2026:27063 vendor-advisory
- RHSA-2026:37580 vendor-advisory
- RHSA-2026:40022 vendor-advisory
- RHSA-2026:40828 vendor-advisory
- RHSA-2026:43227 vendor-advisory
- RHSA-2026:43253 vendor-advisory
- RHSA-2026:43331 vendor-advisory
- RHSA-2026:47703 vendor-advisory
- RHSA-2026:47728 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-46579 vdb-entry
- RHBZ#2483181 issue-tracking