oathkeeper vulnerabilities and fixes

Recent CVEs affecting oathkeeper, with upgrade or downgrade steps. 3 tracked.

oathkeeper has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2026-03-26. Highest priority: CVE-2026-33494 (score 51/100).

• CVE-2026-33496 HIGH 8.1 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques
• CVE-2026-33495 MEDIUM 6.5 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques
• CVE-2026-33494 CRITICAL 10.0 UPGRADE ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques

FAQ

How do I fix oathkeeper vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is oathkeeper being exploited right now?

None of the tracked oathkeeper CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which oathkeeper CVE should I patch first?

CVE-2026-33494 currently ranks highest (51/100): ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP reques.

RSS feed for oathkeeper · ← Back to latest CVEs