CVE-2026-42274 Details
Description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
A vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service, allows for authorization bypass due to improper path normalization. In versions prior to 0.17.14, Heimdall matched rules based on raw request paths, which could include dot-segment patterns that are not safely normalized. This mismatch could lead Heimdall to authorize requests for paths that, when normalized by downstream components, were processed differently. For example, a request to '/user/../admin' could be normalized to '/admin', potentially allowing unauthorized access.
Update Heimdall to version 0.17.14 or later, where this vulnerability has been patched. Additionally, normalize HTTP paths or reject paths containing relative expressions before they reach Heimdall. Some proxies, like Traefik, do this by default, while others, such as Envoy, may require extra configuration.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a | [email protected] | Source CodeVendor |
| https://github.com/dadrus/heimdall/pull/3209 | [email protected] | Source CodeVendor |
| https://github.com/dadrus/heimdall/releases/tag/v0.17.14 | [email protected] | Release NotesVendor |
| https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-35 | Path Traversal: '.../...//' | [email protected] |
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dadrus heimdall | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |