CWE-441 · Access Control
Unintended Proxy or Intermediary
205CVEs
SortMost likely exploited
205 CVEs with CWE-441 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2020-5412CheckSpring Cloud Netflix - Server-Side Request ForgerySpring by VMware · Spring Cloud Netflix · 2020-08-07 | – | 10% | 2020-08-07 |
| CVE-2025-47269code-server session cookie can be extracted by having user visit specially crafted proxy URLcoder · code-server · CVSS 8.3 · 2025-05-09 | 8.3 | 56% | 2025-05-09 |
| CVE-2019-3924MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both W…Tenable · MikroTik RouterOS · 2019-02-20 | – | 16% | 2019-02-20 |
| CVE-2019-3996ELOG 3.1.4-57bea22 and below can be used as an HTTP GET request proxy when unauthenticated remote attackers send crafted HTTP POST requests.Elog Project · ELOG · 2019-12-17 | – | 6.6% | 2019-12-17 |
| CVE-2021-20042An unauthenticated remote attacker can use SMA 100 as an unintended proxy or intermediary undetectable proxy to bypass firewall rules. This vulnerability affected SMA 200, 210, 40…SonicWall · SonicWall SMA100 · 2021-12-08 | – | 3.7% | 2021-12-08 |
| CVE-2019-1841Cisco DNA Center Unintended Proxy Via SWIM Import Interface VulnerabilityCisco · Cisco Digital Network Architecture Center (DNA Center) · CVSS 6.5 · 2019-04-18 | 6.5 | 2.6% | 2019-04-18 |
| CVE-2021-25740Holes in EndpointSlice Validation Enable Host Network HijackKubernetes · Kubernetes · CVSS 3.1 · 2021-09-20 | 3.1 | 2.2% | 2021-09-20 |
| CVE-2020-8561Webhook redirect in kube-apiserverKubernetes · Kubernetes · CVSS 4.1 · 2021-09-20 | 4.1 | 2.1% | 2021-09-20 |
| CVE-2020-26262Loopback bypass in Coturncoturn · coturn · CVSS 7.2 · 2021-01-13 | 7.2 | 1.5% | 2021-01-13 |
| CVE-2018-16598An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component.…Amazon · Freertos · 2018-12-06 | – | 1.5% | 2018-12-06 |
| CVE-2015-2947KanColleViewer versions 3.8.1 and earlier operates as an open proxy which allows remote attackers to trigger outbound network traffic.Grabacr.net · Kancolleviewer · 2017-04-13 | – | 1.5% | 2017-04-13 |
| CVE-2022-39361Metabase vulnerable to Remote Code Execution via H2metabase · metabase · CVSS 8.8 · 2022-10-26 | 8.8 | 1.3% | 2022-10-26 |
| CVE-2021-32783Authorization bypass in Contourprojectcontour · contour · CVSS 8.5 · 2021-07-23 | 8.5 | 1.2% | 2021-07-23 |
| CVE-2026-44494Axios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`axios · axios · CVSS 8.7 · 2026-06-11 | 8.7 | 1.1% | 2026-06-11 |
| CVE-2021-32773Confused deputy attack in sandbox module resolutionracket · racket · CVSS 6.1 · 2021-07-19 | 6.1 | 0.9% | 2021-07-19 |
| CVE-2026-39906Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET RemotingUnisys · WebPerfect Image Suite · CVSS 7 · 2026-04-14 | 7.0 | 0.7% | 2026-04-14 |
| CVE-2026-72526Multicloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotationRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9.9 · 2026-08-12 | 9.9 | 0.7% | 2026-08-12 |
| CVE-2026-49086Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscr…Apache Software Foundation · Apache Camel Dapr · CVSS 6.5 · 2026-07-06 | 6.5 | 0.7% | 2026-07-06 |
| CVE-2026-46592Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTT…Apache Software Foundation · Apache Camel · CVSS 7.5 · 2026-07-06 | 7.5 | 0.6% | 2026-07-06 |
| CVE-2026-94205Gitea fork workflow approval bypass through maintainer-triggered eventsGitea · Gitea · CVSS 9.8 · 2026-10-06 | 9.8 | 0.6% | 2026-10-06 |
| CVE-2026-67567Multicloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restrictionRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9.9 · 2026-08-20 | 9.9 | 0.6% | 2026-08-20 |
| CVE-2026-100706kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPathkyverno · kyverno · CVSS 9.9 · 2026-09-26 | 9.9 | 0.6% | 2026-09-26 |
| CVE-2026-69399Azure Arc Elevation of Privilege VulnerabilityMicrosoft · Azure ARC · CVSS 9.9 · 2026-09-17 | 9.9 | 0.6% | 2026-09-17 |
| CVE-2025-68667Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issuecontinuwuity · continuwuity · CVSS 9.9 · 2025-12-23 | 9.9 | 0.6% | 2025-12-23 |
| CVE-2026-17107Cluster-proxy: impersonation-header injection grants cluster-admin on every managed clusterRed Hat · multicluster engine for Kubernetes 2.10 · CVSS 8.5 · 2026-07-24 | 8.5 | 0.6% | 2026-07-24 |
| CVE-2026-44945Cross-Cluster Impersonation Confused-Deputy Privilege EscalationSUSE · Rancher · CVSS 9.1 · 2026-08-05 | 9.1 | 0.6% | 2026-08-05 |
| CVE-2015-10003FileZilla Server PORT confused deputyFileZilla · Server · CVSS 4.3 · 2022-07-17 | 4.3 | 0.6% | 2022-07-17 |
| CVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypasskyverno · kyverno · CVSS 9.9 · 2026-11-08 | 9.9 | 0.5% | 2026-11-08 |
| CVE-2026-70398Multicloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespaceRed Hat · Red Hat Advanced Cluster Management for Kubernetes 2.11 · CVSS 9.6 · 2026-08-12 | 9.6 | 0.5% | 2026-08-12 |
| CVE-2026-42933Unintended Proxy or Intermediary in Panduit IntraVUE by PronetiqsPronetiqs · Panduit Intravue · CVSS 10 · 2026-07-23 | 10.0 | 0.5% | 2026-07-23 |
| CVE-2026-16920Multiple Vulnerabilities in IBM API ConnectIBM · API Connect · CVSS 9.9 · 2026-11-07 | 9.9 | 0.5% | 2026-11-07 |
| CVE-2026-86115Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Pathsimstudioai · sim · CVSS 5 · 2026-09-05 | 5.0 | 0.5% | 2026-09-05 |
| CVE-2026-81303Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostnameRed Hat · Red Hat build of Apache Camel - HawtIO 4 · CVSS 6.3 · 2026-09-15 | 6.3 | 0.5% | 2026-09-15 |
| CVE-2018-1999038A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect t…Jenkins · Publish Over Cifs · 2018-08-01 | – | 0.5% | 2018-08-01 |
| CVE-2026-101907Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFaxios · axios · CVSS 7 · 2026-09-28 | 7.0 | 0.5% | 2026-09-28 |
| CVE-2025-25061Unintended proxy or intermediary ('Confused Deputy') issue exists in HMI ViewJet C-more series and HMI GC-A2 series, which may allow a remote unauthenticated attacker to use the p…JTEKT ELECTRONICS CORPORATION · HMI ViewJet C-more series · CVSS 5.8 · 2025-04-04 | 5.8 | 0.5% | 2025-04-04 |
| CVE-2026-126227A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through…Fortinet · FortiManager · CVSS 7.2 · 2026-11-11 | 7.2 | 0.5% | 2026-11-11 |
| CVE-2026-30225OliveTin: RestartAction always runs actions as guestOliveTin · OliveTin · CVSS 5.3 · 2026-03-06 | 5.3 | 0.5% | 2026-03-06 |
| CVE-2026-86003CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCPcoredns · coredns · CVSS 7.5 · 2026-09-16 | 7.5 | 0.4% | 2026-09-16 |
| CVE-2026-109373ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookiezitadel · zitadel · CVSS 8.1 · 2026-10-12 | 8.1 | 0.4% | 2026-10-12 |
| CVE-2026-16456Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputyRed Hat · Red Hat OpenShift AI 2.25 · CVSS 6.5 · 2026-08-10 | 6.5 | 0.4% | 2026-08-10 |
| CVE-2026-101905Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionaxios · axios · CVSS 7.6 · 2026-09-28 | 7.6 | 0.4% | 2026-09-28 |
| CVE-2018-12182Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of se…Extensible Firmware Interface Development Kit (EDK II) · Extensible Firmware Interface Development Kit (EDK II) · 2019-03-27 | – | 0.4% | 2019-03-27 |
| CVE-2025-48710kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This…kro.run · kro · CVSS 4.1 · 2025-06-04 | 4.1 | 0.4% | 2025-06-04 |
| CVE-2026-70148Windows Broadcast DVR User Service Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1809 · CVSS 6.5 · 2026-10-13 | 6.5 | 0.4% | 2026-10-13 |
| CVE-2026-50022Metacat acts as unintended proxy to backend Apache SOLR engineNCEAS · metacat · CVSS 5.8 · 2026-09-17 | 5.8 | 0.4% | 2026-09-17 |
| CVE-2024-30128An open proxy vulnerability affects HCL Nomad server on DominoHCL Software · Nomad server on Domino · CVSS 8.6 · 2024-09-25 | 8.6 | 0.4% | 2024-09-25 |
| CVE-2024-34068Server-side Request Forgery during remote file pull in Pterodactyl wingspterodactyl · wings · CVSS 6.4 · 2024-05-03 | 6.4 | 0.4% | 2024-05-03 |
| CVE-2024-9870Unintended Proxy or Intermediary ('Confused Deputy') in GitLabGitLab · GitLab · CVSS 4.3 · 2025-02-12 | 4.3 | 0.4% | 2025-02-12 |
| CVE-2026-87582Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code ou…Google · Chrome · CVSS 8.3 · 2026-09-09 | 8.3 | 0.4% | 2026-09-09 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.