CVE-2026-57210 Details

A vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service, allows for IP spoofing through unvalidated forwarding headers. This issue affects versions of Heimdall prior to 0.17.17. When the trusted_proxies option is enabled, Heimdall extracts client IP addresses from the Forwarded and X-Forwarded-For headers. However, the extracted values are not properly validated, allowing arbitrary strings, malformed IP literals, and certain RFC 7239 values to be accepted without scrutiny. Additionally, the Forwarded header parser improperly handles quoted strings, leading to misinterpretation of IP addresses. This vulnerability can be exploited to manipulate rule evaluations or spoof IP addresses in proxy mode, potentially bypassing access controls or misleading upstream services that rely on X-Forwarded-For headers.

Users can upgrade to Heimdall version 0.17.17 or later, where this vulnerability has been patched. Instructions for downloading the latest version are available on the Heimdall GitHub releases page.