Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ory/oathkeeper

              master @ 6dfb8b6
            

Fixes

CVEs

CRITICAL

Peak severity

35.9%

Coverage

Highlights

Denial of Service: 18 prior fixes. Scrutinize any change in this area.

pipeline/authn: most-fixed (7 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Inadequate URL path canonicalization, unsafe glob evaluation limits, and untrusted forward header parsing directly lead to authorization bypasses. Attackers can leverage path traversal and unstripped headers to match lenient access control rules.

Auth Bypass: The OAuth2 introspection authenticator suffered from multi-tenant token validation cache key confusion. Lacking endpoint context and proper validation checks within cached results allowed cross-endpoint authorization bypasses.

Denial of Service: Execution of untrusted JSONnet configurations was susceptible to infinite loops, excessive memory allocations, and host filesystem escapes without strict system limits and sandboxing.