VDB

CVE-2026-33494

CVE-2026-33494 PUBLISHED CVSS 10 CRITICAL

Ory Oathkeeper has a path traversal authorization bypass

EPSS 0.64% · 48.7th percentile

Risk Scores

CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score
0.64%
48.7th percentile

Affected Products

VendorProductVersions
oryoathkeeper< 26.2.0, < 26.2.0, < 26.2.0
github.comory/oathkeeper0, 0, 0

Timeline

  • Mar 20, 2026 CVE Published
  • Mar 22, 2026 Security Advisory
  • Mar 26, 2026 PoC Published
  • Mar 26, 2026 PoC Published
  • Mar 26, 2026 PoC Published
  • Mar 26, 2026 PoC Published
  • Mar 27, 2026 CVE Updated
  • Mar 29, 2026 PoC Published
  • Apr 7, 2026 PoC Published
  • May 18, 2026 EPSS Score
  • May 19, 2026 EPSS Score
  • May 20, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›