CVE-2026-33494: Oathkeeper Rule Matching Without Path Clean
Access rule matching is performed against an http.Request URL whose path has not been normalized via path.Clean. A request such as "/public/../admin/secrets" will have its raw path matched against rules, so a permissive wildcard rule (e.g. "/public/<.*>") may absorb the "../" segments and bypass the protected rule that governs the resolved path ("/admin/secr
Gogreprules fetch cve-2026-33494-oathkeeper-rule-matching-without-path-clean --engine opengrepDescription
Access rule matching is performed against an http.Request URL whose path has not been normalized via path.Clean. A request such as "/public/../admin/secrets" will have its raw path matched against rules, so a permissive wildcard rule (e.g. "/public/<.*>") may absorb the "../" segments and bypass the protected rule that governs the resolved path ("/admin/secr
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.