CVE-2026-46579

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat OpenShift Container Platform 4.18—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.22—
Red HatRed Hat OpenShift Container Platform 4.12—
Red HatRed Hat OpenShift Container Platform 4.13—
Red HatRed Hat OpenShift Container Platform 4.14—
Red HatRed Hat OpenShift Container Platform 4.15—
Red HatRed Hat OpenShift Container Platform 4.16—
Red HatRed Hat OpenShift Container Platform 4.17—
Red HatRed Hat OpenShift Container Platform 4.18—
Red HatRed Hat OpenShift Container Platform 4.19—
Red HatRed Hat OpenShift Container Platform 4.20—
Red HatRed Hat OpenShift Container Platform 4.21—
Red HatRed Hat OpenShift Container Platform 4.22—

References

Timeline

Published
May 29, 2026
Last modified
Sep 10, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-46586.4The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCVE-2026-465808.8In Eclipse Theia versions prior to 1.71.0, files matching the pattern .prompts/*.prompttemplate in a workspace were automatically loaded andCVE-2026-465817.5In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, aCVE-2026-465823.7In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DCVE-2026-465843.7Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camCVE-2026-465857.5Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucenCVE-2026-465868.8Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval InjectCVE-2026-465877.3Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from CVE-2026-465887.3Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from CVE-2026-46597.5The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Arbitrary File Read via the Repeater JSON/CSV URL parameter in veCVE-2026-465908.8Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata (CVE-2026-465918.2Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component. The camel-neo4j producer bui
CVE-2026-46579: High severity, CVSS 7.5 | Vulnix