HIGHVulnerability
CVE-2026-46579
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Properties
- severity
- HIGH
- score
- 7.4
- cve_id
- CVE-2026-46579
- vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- published_at
- 2026-05-29T11:16:17.050
- last_modified
- 2026-08-11T13:18:54.547
Related Entities (4)
HAS_WEAKNESS (1)
→[Weakness]Improper Authentication
DESCRIBED_BY (1)
→[Source]NVD
AFFECTS_PRODUCT (2)
→[Product]
→[Product]
Explore deeper with Ninja Signal's threat intelligence graph