The Git Gazette

We had a situation that's now been contained. On March 20th, the Ory Oathkeeper team dropped three CVEs simultaneously — and when I say dropped, I mean they detonated like coordinated flash-bangs in the Identity & Access Proxy landscape.

CVE-2026-33494 was the big gun — a CRITICAL path traversal authorization bypass affecting every version before v26.2.0. This is the kind of vulnerability that keeps infrastructure teams awake at night. Path traversal in an IAP means attackers could potentially bypass access controls entirely, which defeats the entire purpose of having an access proxy in the first place. 🚨🚨🚨🚨🚨

CVE-2026-33496 followed with a HIGH-severity authentication bypass via cache key confusion. Cache confusion attacks are particularly nasty because they exploit the performance optimizations that make modern systems usable — turning speed into a security liability.

CVE-2026-33495 rounded out the triple-header with a MEDIUM-severity auth bypass through untrusted headers. While less severe, header injection vulnerabilities in auth systems are nothing to ignore.

Here's the good news: all three vulnerabilities were patched simultaneously in v26.2.0, released the same day as disclosure. This is textbook responsible disclosure and rapid response from the Ory team.

IMMEDIATE ACTION REQUIRED: If you're running Oathkeeper in production, update to v26.2.0 immediately. This isn't a "get to it when convenient" situation — you're running an identity proxy with known critical bypasses.

Patch Wiresec signing off — nice work on the coordinated fix, Ory team.

DEVELOPING: The usually bustling halls of ory/oathkeeper have gone eerily quiet this week, but don't mistake silence for peace, dear readers. Sometimes the most telling drama is what's NOT being said.

Witness exhibit A: Issue #1266, where @xqqp discovered that Oathkeeper 26.2 is playing fast and loose with trailing slashes — stripping them like a overzealous bouncer. Zero comments. Zero reactions. The digital equivalent of crickets chirping. But here's the kicker: this is a bug label, folks. Silence on a bug report? That's not indifference, that's the calm before the storm.

Meanwhile, #1264 presents us with a query string catastrophe courtesy of @LennartKoot. The Decision API is apparently treating query parameters like unwanted party guests, showing them the door via X-Forwarded-Uri. Again, zero engagement. Are we witnessing a community in hibernation or just the eye of a technical hurricane?

But wait — there's a ghost haunting these proceedings! Issue #1154 managed to accumulate 4 whole comments before being marked 'stale' and closed. @qdrddr's desperate pleas of "Hope it'll not be closed" and "Hope it's not forgotten" echo like cries in the digital wilderness.

Sometimes the biggest drama is the sound of issues falling in an empty forest. Will anyone hear them?