CWE-441— Unintended Proxy or Intermediary (Confused Deputy)

The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.— MITRE CWE catalog

253 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-441page 3 of 6

CVE-2026-88235HIGHCVSS 7.8EG 7.8
2026-11-10
Unintended proxy or intermediary ('confused deputy') in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
CVE-2026-49906HIGHCVSS 7.8EG 7.8
2026-11-02
An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navigation app focus. The privileged `Cluste…
CVE-2026-83837HIGHCVSS 7.8EG 7.8
2026-10-13
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-28648HIGHCVSS 7.8EG 7.8
2026-10-05
In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-55270HIGHCVSS 7.8EG 7.8
2026-10-05
In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for expl…
CVE-2026-56945HIGHCVSS 7.8EG 7.8
2026-09-15
In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-45520HIGHCVSS 7.8EG 7.8
2026-09-08
In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed…
CVE-2026-28657HIGHCVSS 7.8EG 7.8
2026-09-08
In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User…
CVE-2026-28644HIGHCVSS 7.8EG 7.8
2026-09-08
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…
CVE-2026-28636HIGHCVSS 7.8EG 7.8
2026-09-08
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. U…
CVE-2026-28624HIGHCVSS 7.8EG 7.8
2026-09-08
In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interactio…
CVE-2026-28616HIGHCVSS 7.8EG 7.8
2026-09-08
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
CVE-2026-28614HIGHCVSS 7.8EG 7.8
2026-09-08
In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed fo…
CVE-2026-28607HIGHCVSS 7.8EG 7.8
2026-09-08
In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2026-28603HIGHCVSS 7.8EG 7.8
2026-09-08
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges n…
CVE-2026-28600HIGHCVSS 7.8EG 7.8
2026-09-08
In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
CVE-2026-0098HIGHCVSS 7.8EG 7.8
2026-06-01
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interact…
CVE-2025-48570HIGHCVSS 7.8EG 7.8
2026-06-01
In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. Us…
CVE-2025-48646HIGHCVSS 7.8EG 7.8
2026-03-02
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploi…
CVE-2025-48628HIGHCVSS 7.8EG 7.8
2025-12-08
In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction …
CVE-2025-48586HIGHCVSS 7.8EG 7.8
2025-12-08
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. Use…
CVE-2025-48555HIGHCVSS 7.8EG 7.8
2025-12-08
In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
CVE-2025-48536HIGHCVSS 7.8EG 7.8
2025-12-08
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional exec…
CVE-2025-22420HIGHCVSS 7.8EG 7.8
2025-12-08
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need…
CVE-2025-32320HIGHCVSS 7.8EG 7.8
2025-09-05
In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-32346HIGHCVSS 7.8EG 7.8
2025-09-04
In onActivityResult of VoicemailSettingsActivity.java, there is a possible work profile contact number leak due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
CVE-2025-32326HIGHCVSS 7.8EG 7.8
2025-09-04
In multiple functions of AppRestrictionsFragment.java, there is a possible way to bypass intent security check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User…
CVE-2025-32324HIGHCVSS 7.8EG 7.8
2025-09-04
In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
CVE-2025-32321HIGHCVSS 7.8EG 7.8
2025-09-04
In isSafeIntent of AccountTypePreferenceLoader.java, there is a possible way to bypass an intent type check due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User int…
CVE-2025-26454HIGHCVSS 7.8EG 7.8
2025-09-04
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges n…
CVE-2025-26452HIGHCVSS 7.8EG 7.8
2025-09-04
In loadDrawableForCookie of ResourcesImpl.java, there is a possible way to access task snapshots of other apps due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User …
CVE-2025-22418HIGHCVSS 7.8EG 7.8
2025-09-02
In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2025-22416HIGHCVSS 7.8EG 7.8
2025-09-02
In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…
CVE-2026-57042HIGHCVSS 6.7EG 7.8
2026-09-15
In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for e…
CVE-2026-115539HIGHCVSS 7.7EG 7.7
2026-11-10
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard…
CVE-2026-105311HIGHCVSS 7.7EG 7.7
2026-10-20
The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cl…
CVE-2026-53514HIGHCVSS 7.7EG 7.7
2026-07-07
Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabl…
CVE-2026-53999HIGHCVSS 7.7EG 7.7
2026-06-12
Radius is a cloud-native, portable application platform that makes app development easier for teams building cloud-native apps. Prior to 0.58.0, the Kubernetes controller deserializes the user-controlled radapp.io/status annotation on a De…
CVE-2026-49821HIGHCVSS 7.7EG 7.7
2026-06-10
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.24.0, Fission's buildermgr controller processed Package CRDs without verifying…
CVE-2026-101905HIGHCVSS 7.6EG 7.6
2026-09-28
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pol…
CVE-2026-107232HIGHCVSS 7.5EG 7.5
2026-10-07
The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the las…
CVE-2026-86003HIGHCVSS 7.5EG 7.5
2026-09-16
CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC listeners in plugin/pkg/doh/doh.go, core/dnsserver/server_quic.go, and core/dnsserver/server_grpc.go call dns.Msg…
CVE-2026-78682HIGHCVSS 7.5EG 7.5
2026-08-25
NLTK before 3.10.3 contains a server-side request forgery vulnerability in nltk.pathsec.urlopen (and callers nltk.data.load, nltk.downloader.Downloader.index/download) when an HTTP proxy is configured. pathsec.urlopen validates the request…
CVE-2026-46592HIGHCVSS 7.5EG 7.5
2026-07-06
Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName …
CVE-2019-3924HIGHCVSS 7.5EG 7.5
2019-02-20
MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can us…
CVE-2026-72668HIGHCVSS 7.3EG 7.3
2026-09-26
Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the id…
CVE-2025-48532HIGHCVSS 7.3EG 7.3
2025-09-04
In markMediaAsFavorite of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed…
CVE-2025-22441HIGHCVSS 7.3EG 7.3
2025-09-04
In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no addi…
CVE-2026-126227HIGHCVSS 7.2EG 7.2
2026-11-11
A unintended proxy or intermediary ('confused deputy') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2.0 through 7.2.12, FortiAnalyzer Cl…
CVE-2026-75886HIGHCVSS 7.2EG 7.2
2026-09-23
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the…

Map vulnerabilities like CWE-441 to your infrastructure

EchelonGraph correlates every CVE — across CWE-441 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →