CVE-2026-46579: Openshift/router: openshift/router: mtls client certificate spoofing via unstripped x-ssl-client headers on http frontend

Synopsis

An mTLS client certificate spoofing flaw in the OpenShift Router lets attackers forge identity headers on the HTTP frontend. When a Route uses insecureEdgeTerminationPolicy: Allow, the router fails to strip X-SSL-Client-* headers from incoming plain HTTP requests, so any unauthenticated attacker on the network can inject crafted headers and impersonate a client certificate identity to backends that trust those headers for mutual TLS. Successful exploitation reads and modifies data behind those backends by assuming arbitrary client identities. No upstream fix is published yet; HarborGuard tracks the advisory and will surface a patched rebuild the moment one ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP requests to the router's HTTP frontend over the network.

• AuthenticationNot required

  No credentials are needed; any unauthenticated client that can reach the HTTP listener can inject the spoofed headers.

• Victim interactionNot required

  Exploitation is a direct request to the router and does not depend on any user action.

• Attack complexityDetail

  AC:H indicates exploitation depends on environmental conditions, specifically a Route configured with insecureEdgeTerminationPolicy: Allow and a backend that trusts X-SSL-Client-* headers for mTLS identity.

Blast Radius

• Impersonates arbitrary client certificate identities to backends that consume X-SSL-Client-* headers, bypassing mutual TLS authentication entirely.
• Reads sensitive data exposed to the impersonated identity, including records and APIs gated on client-cert identity.
• Modifies state on those backends under the spoofed identity, including writes, configuration changes, or privileged actions tied to the forged certificate subject.