IP spoofing in Heimdall via unvalidated forwarding headers
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290.
Summary
Heimdall before 0.17.17 accepts client IP addresses from the Forwarded and X-Forwarded-For headers without checking that they are valid IP addresses when trusted_proxies is configured. The Forwarded header parser also splits quoted values on commas and semicolons, so one quoted value can be read as several addresses. An unauthenticated remote attacker can send crafted headers so that the rule pipeline sees an arbitrary client IP address, which enables authentication bypass by spoofing (CWE-290).
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dadrus | heimdall | before 0.17.17 | 0.17.17 | Patch available | CNA |
| — | https://github.com/dadrus/heimdall (Go) | before 0.17.17 | 0.17.17 | Patch available | GHSA-38x9-25wx-7fg2 |
- heimdall Vendordadrus Affected before 0.17.17 Fixed in 0.17.17 Patch available CNA
- https://github.com/dadrus/heimdall (Go) Vendor— Affected before 0.17.17 Fixed in 0.17.17 Patch available GHSA-38x9-25wx-7fg2
Remediation
Upgrade the Heimdall Go module to version 0.17.17. The sources list no fixed version for heimdall.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA heimdall (dadrus) Fixed in 0.17.17
- Fix · GHSA-38x9-25wx-7fg2 https://github.com/dadrus/heimdall (Go) Fixed in 0.17.17 Advisory →
Timeline
- 2026-10-23 Threatist record created from CVE-2026-57210
- 2026-10-24 Priority changed: MEDIUM → LOW
- 2026-10-29 CISA SSVC decision points changed
References
More dadrus vulnerabilities
- TI-2026-25280 Heimdall: Path received via Envoy gRPC corrupted when containing query string CVSS 3.1HIGH 8.2
- TI-2026-79758 Forwarded header injection in Heimdall proxy mode via Host header CVSS 4.0HIGH 7.0
- TI-2026-30583 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVSS 4.0HIGH 7.8
- TI-2026-30585 Heimdall: Authorization bypass via path normalization mismatch CVSS 4.0HIGH 7.8
- TI-2026-30584 Heimdall: Case-sensitive host matching may lead to policy bypass CVSS 4.0HIGH 7.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences