What landed in CVE-land this week

This week's batch covers a Windows RPC local-privilege bug destined for every red-teamer's post-exploitation kit, a header-parsing quirk in an OpenShift auth proxy that weaponizes a decades-old CGI footgun for identity spoofing, a KubeVirt path-resolution race that revives the classic /proc/self/fd link-following pitfall, and a WordPress plugin SQL injection that reads like 2011. The list is ordered by defender priority, not CVSS.

CVE-2026-49332 — oauth-proxy underscore/dash header confusion (CVSS 8.5)

The standout application-security bug this week is the identity-header handling flaw in openshift/oauth-proxy. The proxy authoritatively sets headers such as X-Forwarded-User and X-Forwarded-Email after a successful login, but strips only the dash-variant on ingress—not the underscore-variant. That gap matters because WSGI, PHP-FPM, and similar frameworks normalize HTTP header names by uppercasing and replacing dashes with underscores: X-Forwarded-User and X_Forwarded_User both land in HTTP_X_FORWARDED_USER, and getenv() lookup ordering is undefined.

An unauthenticated attacker can send X_Forwarded_User: admin@example.com and, depending on the framework behind the proxy, be treated as admin@example.com without completing an OAuth flow.

This bug class is not new—it shares the shape of CVE-2018-1000164 in gunicorn and the underscore-normalization behavior Nginx documents under underscores_in_headers. Patch oauth-proxy, and while you wait, add a defensive rule at the ingress. For Nginx:

# Drop underscore-variants of any header we treat as authoritative.
map $http_x_forwarded_user $has_dash_user { default 1; "" 0; }

server {
  # Nginx already drops underscore headers by default; make it explicit.
  underscores_in_headers off;

  location / {
    # Belt-and-braces: nuke anything that could collide in WSGI/PHP env.
    proxy_set_header X_Forwarded_User  "";
    proxy_set_header X_Forwarded_Email "";
    proxy_set_header X_Forwarded_Groups "";
    proxy_pass http://oauth_proxy_upstream;
  }
}

If you can't touch the ingress, hunt for inbound requests where X_Forwarded_* headers arrive from outside your oauth-proxy pod CIDR. Legitimate traffic produces zero hits; the detection is cheap.

CVE-2026-13201 — KubeVirt safepath symlink race (CVSS 7.3)

virt-handler opens path leaves with O_PATH|O_NOFOLLOW, then reissues syscalls via /proc/self/fd/N. The flaw: /proc/self/fd/N re-resolves symlinks on link-following syscalls (open, chown, chmod without AT_SYMLINK_NOFOLLOW). A container with write access to a shared volume can swap the leaf between the openat and the subsequent operation, steering the host into touching an arbitrary path.

The fix is the same as for any bug in this class: never re-resolve via /proc/self/fd. Use the *at family with AT_EMPTY_PATH and AT_SYMLINK_NOFOLLOW, or openat2(RESOLVE_NO_SYMLINKS|RESOLVE_BENEATH) on kernels that support it. If you maintain a similar safepath abstraction, audit now:

$ rg -n "/proc/self/fd/" --type go
$ rg -n "O_PATH" --type go -A 3 | rg -B 2 "os\.(Chown|Chmod|Rename|Remove)"

Any match where the second operation is a link-following syscall is a candidate for the same vulnerability.

CVE-2026-42976 — Windows RPC local EoP (CVSS 7.8)

"Missing authentication for critical function in Windows RPC API." The MSRC advisory is sparse, but the shape is familiar: an authenticated local user calls an RPC interface that bypasses the required privilege check. Expect fast weaponization—RPC LPEs have a long exploitation tail because the attack surface is large and detection is difficult. Priorities:

  1. Patch on your next Patch Tuesday cadence; no meaningful mitigation exists short of the update.
  2. Enable the RPC filter audit channel (Microsoft-Windows-RPC/Debug) on a canary host and baseline which interface UUIDs are called by non-SYSTEM tokens. Anything new after the CVE drops warrants investigation.
  3. If you ship EDR with kernel callbacks, detect token elevation immediately following an RPC endpoint bind from a medium-integrity process.

CVE-2025-5318 — libssh OOB read in sftp_handle (CVSS 5.4)

An out-of-bounds read in a server-side SFTP handle lookup. Not directly exploitable for RCE, but information disclosure on an SSH server is a viable component of an ASLR-bypass chain. If you embed libssh—many appliances do—take the 0.11.2 bump. If you don't know whether you embed it, that uncertainty is itself a finding.

CVE-2024-45497 — OpenShift docker-build hostPath credential exposure (CVSS 7.6)

An older bug still resurfacing in air-gapped clusters that lag upstream. The docker-build pod mounts /var/lib/kubelet/config.json from the node via a hostPath volume; anyone who can trigger a build pod can read the node's pull-secret. The fix is upstream; the compensating control is a Kyverno or OPA policy that denies hostPath mounts targeting /var/lib/kubelet from any pod outside a narrow allow-list of system namespaces.

CVE-2024-11831 and CVE-2026-11973 — the boring, dangerous long tail

serialize-javascript (CVE-2024-11831) fails to sanitize regex literals and several other object types, enabling XSS when serialized output is embedded in a page. Confirm you're on ≥ 6.0.2. WP-Lister Lite for eBay (CVE-2026-11973) is a textbook ORDER BY injection—orderby concatenates directly into the query with no allow-list. Update the plugin; if you can't, add a ModSecurity rule rejecting orderby values that don't match ^[a-zA-Z_]+$.

CVE-2026-2671 — Bluetooth cleartext on a neurofeedback headset (CVSS 3.1)

A consumer BLE device transmits sensitive data without link-layer encryption. Low CVSS, high embarrassment if the device lands in an executive's home office. If you run a BYOD program, verify whether your MDM posture policy accounts for unpaired BLE peripherals.

What to do this week

None of this week's CVEs are extinction-level. All of them are the quiet, patch-me-Tuesday class that ends up in an incident postmortem six months from now because nobody read the digest.

Verifiable security.