After upgrading to Oathkeeper 26.2 I ran into this...
# contributorsn
numerous-train-41719
03/26/2026, 2:52 PMAfter upgrading to Oathkeeper 26.2 I ran into this issue: https://github.com/ory/oathkeeper/issues/1266. This makes Oathkeeper unusable for me. Can the team take a look?
👀 1
m
magnificent-energy-493
03/26/2026, 6:13 PM
why unusable?
All I can tell you that it is related to this critical vuln: https://github.com/ory/oathkeeper/security/advisories/GHSA-p224-6x5r-fjpm
n
numerous-train-41719
03/27/2026, 11:35 AMBecause my upstream server does not accept requests that do not have the trailing slash.
numerous-train-41719
03/27/2026, 1:43 PM@magnificent-energy-493 How about checking if the raw path, before calling path.Join(), has a trailing slash, call path.Join() and then add a trailing slash if necessary? This way the path traversal is prevented and the correct upstream URL is called.
m
magnificent-energy-493
03/27/2026, 6:12 PM
Tbh I'm not the right person to answer if that makes sense or not.
You could add some more context to your issue (e.g. why is this impacting you, what are other alternatives you considered and so on) - that would help the maintainers.
Right now it looks like you are the only one (?) affected by this - not sure if that is actually the case of course.
n
numerous-train-41719
05/23/2026, 4:54 PMHappy to report that there is another person affected by this: https://github.com/ory/oathkeeper/pull/1272. Regarding adding more context, the issue is pretty basic, not sure what to add: Oathkeeper is modifying the original URL, that should not happen.
👀 1
3 Views