CVE-2026-40575

Mitigation

• Strip any client-provided X-Forwarded-Uri header at the reverse proxy or load balancer level

• Explicitly overwrite X-Forwarded-Uri with the actual request URI before forwarding requests to OAuth2 Proxy

  Example nginx mitigation for the auth subrequest:

    location /internal-auth/ {
      internal; # Ensure external users can't access this path
  
      # Make sure the OAuth2 Proxy knows where the original request came from.
      proxy_set_header Host       $host;
      proxy_set_header X-Real-IP  $remote_addr;
      # set the value to the actual $request_uri and therefore strip any user provided X-Forwarded-Uri
      proxy_set_header X-Forwarded-Uri $request_uri;
  
      proxy_pass http://oauth2-proxy:4180/;
    }
  

• Restrict direct client access to OAuth2 Proxy so it can only be reached through a trusted reverse proxy

• Remove or narrow --skip-auth-route / --skip-auth-regex rules where possible

A configuration-dependent authentication bypass exists in OAuth2 Proxy.

Deployments are affected when all of the following are true:

• OAuth2 Proxy is configured with --reverse-proxy
• and at least one rule is defined with --skip_auth_routes or the legacy --skip-auth-regex

OAuth2 Proxy may trust a client-supplied X-Forwarded-Uri header when --reverse-proxy is enabled and --skip-auth-route or --skip-auth-regex is configured. An attacker can spoof this header so OAuth2 Proxy evaluates authentication and skip-auth rules against a different path than the one actually sent to the upstream application.

This can result in an unauthenticated remote attacker bypassing authentication and accessing protected routes without a valid session.

CVE-2026-40575 has a CVSS score of 9.1 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (7.15.2); upgrading removes the vulnerable code path.

Kodem intelligence

This issue is addressed as part of the newly introduced --trusted-proxy-ip flag in v7.15.2. If you leave it unset, OAuth2 Proxy will continue to trust ALL source IPs (0.0.0.0/0) for backwards compatibility, which means a client may still be able to spoof forwarded headers. Therefore after upgrading we urge you to use the new --trusted-proxy-ip flag to set the IPs or CIDR ranges of the reverse proxies that are allowed to send X-Forwarded-* headers and furthermore implement the mitigation steps outlined below to properly configure your load balancer infrastructure.

1. What is CVE-2026-40575? CVE-2026-40575 is a critical-severity security vulnerability in github.com/oauth2-proxy/oauth2-proxy/v7 (go), affecting versions >= 7.5.0, < 7.15.2. It is fixed in 7.15.2.
2. How severe is CVE-2026-40575? CVE-2026-40575 has a CVSS score of 9.1 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of github.com/oauth2-proxy/oauth2-proxy/v7 are affected by CVE-2026-40575? github.com/oauth2-proxy/oauth2-proxy/v7 (go) versions >= 7.5.0, < 7.15.2 is affected.
4. Is there a fix for CVE-2026-40575? Yes. CVE-2026-40575 is fixed in 7.15.2. Upgrade to this version or later.
5. Is CVE-2026-40575 exploitable, and should I be worried? Whether CVE-2026-40575 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-40575 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-40575? Upgrade github.com/oauth2-proxy/oauth2-proxy/v7 to 7.15.2 or later.