CVE-2026-57210
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Heimdall, when trusted_proxies is configured, client IP addresses are extracted from Forwarded and X-Forwarded-For headers and exposed as Request.ClientIPAddresses without syntactic validation. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values are accepted, and the Forwarded header parser mishandles quoted strings, potentially parsing a single value as multiple entries. The issue is patched in version 0.17.17.
Risk Assessment
Malformed IP addresses can bypass IP-based access control rules, leading to unauthorized access to protected resources. This can weaken security policies that rely on trusted proxies.
Recommendation
Update Heimdall to version 0.17.17 or later. Until patched, consider disabling trusted_proxies or tightening IP-based rules.
Other vulnerabilities in Heimdall
See all- CVE-2026-57209High
In Heimdall proxy mode, the Forwarded HTTP header is constructed by inserting the incoming Host header value without sanitizing commas or semicolons. An attacker can inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. The issue is patched in version 0.17.17.
- CVE-2026-107449Low
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, allowing an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
- CVE-2026-82477Medium
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- CVE-2026-42274High
Heimdall prior to version 0.17.14 performs rule matching on the raw request path, which may lead to unauthorized access. Due to the discrepancy in path normalization, Heimdall may authorize requests for one path while downstream components process a different, normalized path.
- CVE-2026-42273High
Heimdall, an identity-aware proxy and access control service, prior to version 0.17.14, performed host matching in a case-sensitive manner, which is inconsistent with the fact that HTTP hostnames are case-insensitive. This can lead to misclassification of requests that differ only in letter casing.
- CVE-2026-42272High
Heimdall, a proxy and access control service, prior to version 0.17.14 handled URL-encoded slashes in a case-sensitive manner, leading to request path interpretation issues. As a result, the lowercase equivalent (%2f) was not recognized, potentially resulting in authorization bypass.
Original NVD description (English source)
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS