Heimdall vulnerabilities
4 known CVE vulnerabilities in Heimdall, translated and rated.
- CVE-2026-82477Medium
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- CVE-2026-42274High
Heimdall prior to version 0.17.14 performs rule matching on the raw request path, which may lead to unauthorized access. Due to the discrepancy in path normalization, Heimdall may authorize requests for one path while downstream components process a different, normalized path.
- CVE-2026-42273High
Heimdall, an identity-aware proxy and access control service, prior to version 0.17.14, performed host matching in a case-sensitive manner, which is inconsistent with the fact that HTTP hostnames are case-insensitive. This can lead to misclassification of requests that differ only in letter casing.
- CVE-2026-42272High
Heimdall, a proxy and access control service, prior to version 0.17.14 handled URL-encoded slashes in a case-sensitive manner, leading to request path interpretation issues. As a result, the lowercase equivalent (%2f) was not recognized, potentially resulting in authorization bypass.