Heimdall: Authorization bypass via path normalization mismatch
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dadrus | heimdall | before 0.17.14 | 0.17.14 | Patch available | CNA |
| — | github.com/dadrus/heimdall (Go) | before 0.17.14 | 0.17.14 | Patch available | GHSA-3q34-rx83-r6mq |
- heimdall Vendordadrus Affected before 0.17.14 Fixed in 0.17.14 Patch available CNA
- github.com/dadrus/heimdall (Go) Vendor— Affected before 0.17.14 Fixed in 0.17.14 Patch available GHSA-3q34-rx83-r6mq
Remediation
- Fix · CNA heimdall (dadrus) Fixed in 0.17.14
- Fix · GHSA-3q34-rx83-r6mq github.com/dadrus/heimdall (Go) Fixed in 0.17.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42274
- 2026-10-03 Alias added: GHSA-3q34-rx83-r6mq
References
Other 7
- https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq
- https://github.com/dadrus/heimdall/pull/3209
- https://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a
- https://github.com/dadrus/heimdall/releases/tag/v0.17.14
- https://github.com/dadrus/heimdall
- https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-normalize-path
- https://www.rfc-editor.org/rfc/rfc3986#section-6.2.2.3
More dadrus vulnerabilities
- TI-2026-25280 Heimdall: Path received via Envoy gRPC corrupted when containing query string CVSS 3.1HIGH 8.2
- TI-2026-79758 Forwarded header injection in Heimdall proxy mode via Host header CVSS 4.0HIGH 7.0
- TI-2026-30583 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVSS 4.0HIGH 7.8
- TI-2026-30584 Heimdall: Case-sensitive host matching may lead to policy bypass CVSS 4.0HIGH 7.8
- TI-2026-79759 IP spoofing in Heimdall via unvalidated forwarding headers CVSS 4.0HIGH 7.0
Sources
- CVE-2026-42274 · CVE Program
- CVE-2026-42274 · NVD
- FIRST EPSS
- GHSA-3q34-rx83-r6mq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences