CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
Also known as Confused Deputy.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- axios, red hat cryostat 4, gatekeeper 3 +65 more +67 moreAxios: Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`8.7 High
- jpadilla pyjwtPyJWKClient: missing scheme allowlist enables SSRF + token forgery via file://, ftp://, data: schemes4.2 Medium
- gitlabUnintended Proxy or Intermediary ('Confused Deputy') in GitLab5.8 Medium
- grapheneosGrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a...2.2 Low
- pyload, pyload-ng project pyload-ng +1 morepyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy8.3 High
- openclawOpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files4.1 Medium
- miyagawa plack::middleware::xsendfile, plack\ +1 morePlack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting9.1 Critical
- openclawOpenClaw 2026.4.5 through 2026.4.19 - MiniMax API Host Override via Workspace dotenv4.1 Medium
- go-kratos kratosgo-kratos http.DefaultServeMux Fallback server.go NewServer confused deputy6.9 Medium
- axios, red hat cryostat 4, gatekeeper 3 +56 more +58 moreAxios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.07.2 High
- tungsten automation capture (formerly kofax capture)Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting9.3 Critical
- unisys webperfect image suiteUnisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting7.0 High
- kyvernokyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token8.1 High
- aiven aiven-operator, operator +1 moreAiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource6.8 Medium
- axios, red hat cluster observability operator 1.5.0, cryostat 4 +60 more +62 moreAxios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF6.3 Medium
- openclawOpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History5.3 Medium
- jlowin fastmcpFastMCP: Missing Consent Verification in OAuth Proxy Callback Facilitates Confused Deputy Vulnerabilities8.2 High
- withastro astro, astro \@astrojs\/vercel +1 moreAstro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`6.5 Medium
- olivetinOliveTin: RestartAction always runs actions as guest5.3 Medium
- openclawOpenClaw < 2026.2.14 - Remote Code Execution via Node Invoke Approval Bypass9.4 Critical
- google androidIn multiple locations, there is a possible privilege escalation due to a confused deputy. This...8.4 High
- google androidIn gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due...8.4 High
- google androidIn hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user...8.4 High
- google androidIn setupLayout of PickActivity.java, there is a possible way to start any activity as a...8.4 High
- google androidIn executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused...7.8 High
- google androidIn multiple functions of MediaProvider.java, there is a possible external storage write...8.4 High
- coturnCoturn: IPv4-mapped IPv6 (::ffff:0:0/96) bypasses denied-peer-ip ACL7.2 High
- amd instinct™ mi210, instinct™ mi250 +1 moreAn unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a...7.2 High
- continuwuityImproper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')9.3 Critical
- zalando skipperSkipper Ingress Controller Allows Unauthorized Access to Internal Services via ExternalName8.1 High
- surrealdbSurrealDB before 2.5.0 Privilege Escalation via Future Fields7.5 High
- nuvation energy ncloud vpn serviceNuvation Energy nCloud Client-to-Client Communication9.4 Critical
- nuvation energy multi-stack controller (msc), nuvationenergy nplatform +1 moreNuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access7.9 High
- giteaGitea sometimes mishandles propagation of token scope for access control within one of its own package registries5.0 Medium
- continuwuityConduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue9.9 Critical
- red hat lightspeed (formerly insights) for runtimes 1.0, runtimes inventory operator +1 moreInsights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands8.7 High
- fastify fastify-reply-from, reply-from +1 morefastify-reply-from bypass of reply forwarding6.9 Medium
- google androidIn validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image...7.8 High
- google androidIn multiple locations, there is a possible way to alter the primary user's face unlock settings...6.6 Medium
- google androidIn onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from...7.8 High
- google androidIn multiple functions of NotificationStation.java, there is a possible cross-profile information...7.8 High
- google androidIn grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for...7.8 High
- google androidIn onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused...5.5 Medium
- google androidIn multiple locations, there is a possible way to leak audio files across user profiles due to a...7.8 High
- rackRack has Possible Information Disclosure Vulnerability5.8 Medium
marimoPyPImarimo vulnerable to proxy abuse of /mpl/{port}/6.9 Medium- google androidIn System UI, there is a possible way to view other users' images due to a confused deputy. This...7.8 High
- google androidIn App Widget, there is a possible Information Disclosure due to a confused deputy. This could...5.5 Medium
- google androidIn AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a...5.5 Medium
- google androidIn multiple locations, there is a possible leak of an image across the Android User isolation...5.0 Medium
- Show moreLoading…