CVE-2026-46579: Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend
A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46579?
The severity of CVE-2026-46579 is rated high at 7.4.
How do I fix CVE-2026-46579?
To fix CVE-2026-46579, ensure that the 'insecureEdgeTerminationPolicy' is not set to Allow for routes and properly validate incoming headers.
What are the potential risks associated with CVE-2026-46579?
The risks associated with CVE-2026-46579 include allowing unauthenticated attacks through spoofed client certificates, potentially compromising security.
Who is affected by CVE-2026-46579?
Organizations using the Red Hat OpenShift Router with the insecureEdgeTerminationPolicy set to Allow are affected by CVE-2026-46579.
How can I identify if my system is vulnerable to CVE-2026-46579?
To identify if your system is vulnerable to CVE-2026-46579, check the configuration of OpenShift Router for the insecureEdgeTerminationPolicy setting and monitor incoming requests for unstripped headers.