Read the docs
TI-2026-79758 Aliases CVE-2026-57209

Forwarded header injection in Heimdall proxy mode via Host header

Priority HIGH 70CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Heimdall versions before 0.17.17 are affected. In proxy mode, Heimdall builds the Forwarded header by inserting the incoming Host header without removing commas or semicolons (CWE-74). A remote attacker without privileges or user interaction can add parameters to the Forwarded header and spoof IP addresses seen by upstream services.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00488 42nd percentileScored 2026-11-07
Fix Fixed heimdall (dadrus): 0.17.17github.com/dadrus/heimdall (Go): 0.17.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dadrusheimdallbefore 0.17.170.17.17Patch availableCNA
—github.com/dadrus/heimdall (Go)before 0.17.170.17.17Patch availableGHSA-4jgr-pg2m-m988
  • heimdall Vendordadrus Affected before 0.17.17 Fixed in 0.17.17 Patch available CNA
  • github.com/dadrus/heimdall (Go) Vendor— Affected before 0.17.17 Fixed in 0.17.17 Patch available GHSA-4jgr-pg2m-m988

Remediation

Upgrade Heimdall to version 0.17.17, which contains the fix for the github.com/dadrus/heimdall Go module.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA heimdall (dadrus) Fixed in 0.17.17
  • Fix · GHSA-4jgr-pg2m-m988 github.com/dadrus/heimdall (Go) Fixed in 0.17.17 Advisory →

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-57209
  2. 2026-10-24 Priority changed: MEDIUM → LOW
  3. 2026-10-29 CISA SSVC decision points changed
  4. 2026-10-29 Priority changed: LOW → HIGH

References

Other 3

  • TI-2026-25280 Heimdall: Path received via Envoy gRPC corrupted when containing query string CVSS 3.1HIGH 8.2
  • TI-2026-30583 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVSS 4.0HIGH 7.8
  • TI-2026-30585 Heimdall: Authorization bypass via path normalization mismatch CVSS 4.0HIGH 7.8
  • TI-2026-30584 Heimdall: Case-sensitive host matching may lead to policy bypass CVSS 4.0HIGH 7.8
  • TI-2026-79759 IP spoofing in Heimdall via unvalidated forwarding headers CVSS 4.0HIGH 7.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences