CVE-2026-33494: Ory Oathkeeper has a path traversal authorization bypass

March 20, 2026 (updated March 27, 2026)

Ory Oathkeeper is vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path traversal sequences (e.g. /public/../admin/secrets) that resolves to a protected path after normalization, but is matched against a permissive rule because the raw, un-normalized path is used during rule evaluation.

References

github.com/advisories/GHSA-p224-6x5r-fjpm
github.com/ory/oathkeeper
github.com/ory/oathkeeper/commit/8e0002140491c592db41fa141dc6ad68f417e2b2
github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm
nvd.nist.gov/vuln/detail/CVE-2026-33494

Code Behaviors & Features

Detect and mitigate CVE-2026-33494 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →