CVE-2026-42274
HighSummary
Heimdall prior to version 0.17.14 performs rule matching on the raw request path, which may lead to unauthorized access. Due to the discrepancy in path normalization, Heimdall may authorize requests for one path while downstream components process a different, normalized path.
Risk Assessment
The organization may be exposed to unauthorized access to resources, potentially leading to data leaks or security breaches. Specifically, an attacker could exploit this vulnerability to gain access to sensitive areas of the application.
Recommendation
It is recommended to update Heimdall to version 0.17.14 or later to mitigate this vulnerability. Additionally, it is advisable to review the configuration of the allow_encoded_slashes and no_decode options.
Other vulnerabilities in Heimdall
See all- CVE-2026-82477Medium
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- CVE-2026-42273High
Heimdall, an identity-aware proxy and access control service, prior to version 0.17.14, performed host matching in a case-sensitive manner, which is inconsistent with the fact that HTTP hostnames are case-insensitive. This can lead to misclassification of requests that differ only in letter casing.
- CVE-2026-42272High
Heimdall, a proxy and access control service, prior to version 0.17.14 handled URL-encoded slashes in a case-sensitive manner, leading to request path interpretation issues. As a result, the lowercase equivalent (%2f) was not recognized, potentially resulting in authorization bypass.
Original NVD description (English source)
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.