WS-2023-0113

A hop-by-hop abuse was found in oathkeeper. Downstream services relying on the presence of headers set by the header mutator could be exploited. A client can drop the header set by the header mutator by including that header's name in the Connection header. The X-Subject header will not arrive at...

Hop-by-hop abuse to malform header mutator

Impact Downstream services relying on the presence of headers set by the header mutator could be exploited. A client can drop the header set by the header mutator by including that header's name in the Connection header. Example minimal config: yaml - id: 'example' upstream: url:...