Vulnerability Description
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role instead. This allows a low-privileged authenticated attacker who knows the shared credential to perform actions reserved for a higher-privileged role.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-90447?
CVE-2026-90447 is a documented vulnerability. A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client ca...
How severe is CVE-2026-90447?
CVSS scoring is not yet available for CVE-2026-90447. Check NVD for updates.
Is there a patch for CVE-2026-90447?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.