Detections
Analytics

SCA: security update for github.com/oauth2-proxy/oauth2-proxy/v7 (GHSA-652x-m2gr-hppm)

medium Tenable Self-Hosted Container Security Plugin ID 428688

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other
 providers. The `--gitlab-group` flag for group-based authorization in the GitLab provider stopped working
 in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted. Additionally, any
 authenticated users had whichever groups were set in `--gitlab-group` added to the new `X-Forwarded-
 Groups` header to the upstream application. While adding GitLab project based authorization support in
 #630, a bug was introduced where the user session's groups field was populated with the `--gitlab-group`
 config entries instead of pulling the individual user's group membership from the GitLab Userinfo
 endpoint. When the session groups where compared against the allowed groups for authorization, they
 matched improperly (since both lists were populated with the same data) so authorization was allowed. This
 impacts GitLab Provider users who relies on group membership for authorization restrictions. Any
 authenticated users in your GitLab environment can access your applications regardless of `--gitlab-group`
 membership restrictions. This is patched in v7.1.0. There is no workaround for the Group membership bug.
 But `--gitlab-project` can be set to use Project membership as the authorization checks instead of groups;
 it is not broken. (CVE-2021-21411)

See Also

https://github.com/advisories/GHSA-652x-m2gr-hppm

Plugin Details

Severity: Medium

ID: 428688

Version: Revision 1.2

Type: Local

Family: SCA Checks

Published: 7/30/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2021-21411

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/30/2025

Vulnerability Publication Date: 3/26/2021

Reference Information

CVE: CVE-2021-21411