high severity · published 2026-11-13
An authenticated user can send an X-Upstream-Authorization header that overrides the gateway-managed upstream credential. Upstream requests then run with a different credential, bypassing per-user permissions and breaking audit attribution.
CVE: CVE-2026-110279
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 3249 and your operating system.