CWE-441: Unintended Proxy or Intermediary
The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere.
Also known as Confused Deputy.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- google androidIn screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of...3.3 Low
- google androidIn onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI...7.8 High
- google androidIn startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission...7.8 High
- google androidIn setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps"...7.8 High
- google androidIn multiple locations, there is a possible read/write access to files without the proper...7.8 High
- google androidIn Setup Wizard, there is a possible way to force connection to a malicious network due to...7.8 High
- google androidIn onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a...7.8 High
- google androidIn multiple functions in multiple locations, there is a possible background activity launch...7.8 High
- google androidIn assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read...7.8 High
- google androidIn onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app...7.8 High
- google androidIn CPM, there is a possible information disclosure due to a confused deputy. This could lead to...4.4 Medium
- ellite wallosWallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.php`8.2 High
- nltkNLTK before 3.10.3 SSRF Protection Bypass via Proxy8.7 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-operators-subscription: multicloud-operators-subscription: helmrelease chart applied with controller sa without gvk or namespace restriction9.9 Critical
- magicmirrororg magicmirrorMagicMirror: ssrf calendar .js6.3 Medium
- elastic cloud on kubernetes, eck operator +1 moreUnintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure6.5 Medium
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreClusterclaims-controller: confused deputy: tenant-controlled clusterclaim labels propagated to managedcluster, enabling cross-tenant managedclusterset join7.1 High
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-integrations: multicloud-integrations: gitopscluster.spec.argoserver.argonamespace writes spoke bearer tokens to attacker-chosen namespace9.6 Critical
- red hat advanced cluster management for kubernetes 2.11, advanced cluster management for kubernetes 2.13, advanced cluster management for kubernetes 2.14 +3 more +5 moreMulticloud-integrations: multicloud-integrations: pull-model propagation allows hub tenant to target arbitrary spoke cluster via unvalidated ocm-managed-cluster annotation9.9 Critical
- wei-shaw sub2apiSub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstream endpoints using pooled account credentials8.5 High
- red hat openshift ai 2.25, openshift ai 3.3, openshift ai 3.4 +2 moreOdh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy6.5 Medium
- datadog android appThe OnCallNotificationActivity in the Datadog Android application is declared android:exported=...6.5 Medium
- suse rancherCross-Cluster Impersonation Confused-Deputy Privilege Escalation9.1 Critical
- acacode swagger-typescript-apiswagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`6.1 Medium
- appium java-clientAppium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor8.2 High
- red hat multicluster engine for kubernetes 2.10, multicluster engine for kubernetes 2.11, multicluster engine for kubernetes 2.17 +3 more +5 moreCluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster8.5 High
- pronetiqs panduit intravueUnintended Proxy or Intermediary in Panduit IntraVUE by Pronetiqs10.0 Critical
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters7.1 High
- withastro astroAstro: Unauthenticated path override in the @astrojs/vercel ISR function6.5 Medium
- @fastify/reply-from, fastify fastify\/reply-from +1 more@fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision8.7 High
- julien040 anyqueryAnyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode8.6 High
- snowflake spark connectorInput Validation Vulnerabilities in Snowflake Spark Connector9.2 Critical
- decolua 9router9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs8.3 High
- google apigeeCross-Tenant Data Exfiltration in Apigee via BigQuery Confused Deputy5.9 Medium
- @better-auth sso, better-auth, better-auth better auth +1 more +3 moreBetter Auth: Server-side request forgery via unvalidated OIDC endpoints on @better-auth/sso provider registration9.6 Critical
- better-auth better auth, better-auth +1 moreBetter Auth: Unauthorized invitation acceptance via unverified email match in organization plugin7.7 High
- coderCoder's subdomain workspace app routing trusts unauthenticated X-Forwarded-Host header, enabling cross-app data access5.8 Medium
- apache camel, apache software foundation camel dapr +1 moreApache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can publish to the subscribed topic to influen…6.5 Medium
- apache camelApache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect…7.5 High
- red hat streams for apache kafka 2, streams for apache kafka 3.2.1, strimzi strimzi-kafka-operator +2 moreStrimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`8.0 High
- nocodbNocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint6.9 Medium
- angularAngular Service Worker Policy-Bypass & Credential-Stripping Vulnerabilities5.7 Medium
- webpack-dev-serverwebpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies5.3 Medium
- radius-project radiusRadius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)7.7 High
- fissionFission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration7.7 High
- siderolabs omniOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic2.7 Low
- No product listedMercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to...8.8 High
- google androidIn getCallingPackageName of Shared.java, there is a possible way to bypass activity start...7.8 High
- google androidIn multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity...7.8 High
- sparkle project sparkleSparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection4.2 Medium
- Show moreLoading…