CVE-2026-42272
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Heimdall, a proxy and access control service, prior to version 0.17.14 handled URL-encoded slashes in a case-sensitive manner, leading to request path interpretation issues. As a result, the lowercase equivalent (%2f) was not recognized, potentially resulting in authorization bypass.
Risk Assessment
Organizations may be at risk of unauthorized access to resources, as differences in path interpretation could lead to bypassing security mechanisms.
Recommendation
It is recommended to upgrade to version 0.17.14 or later to mitigate this vulnerability and ensure that the allow_encoded_slashes option is properly configured.
Other vulnerabilities in Heimdall
See all- CVE-2026-57210High
In Heimdall, when trusted_proxies is configured, client IP addresses are extracted from Forwarded and X-Forwarded-For headers and exposed as Request.ClientIPAddresses without syntactic validation. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values are accepted, and the Forwarded header parser mishandles quoted strings, potentially parsing a single value as multiple entries. The issue is patched in version 0.17.17.
- CVE-2026-57209High
In Heimdall proxy mode, the Forwarded HTTP header is constructed by inserting the incoming Host header value without sanitizing commas or semicolons. An attacker can inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. The issue is patched in version 0.17.17.
- CVE-2026-107449Low
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, allowing an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
- CVE-2026-82477Medium
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- CVE-2026-42274High
Heimdall prior to version 0.17.14 performs rule matching on the raw request path, which may lead to unauthorized access. Due to the discrepancy in path normalization, Heimdall may authorize requests for one path while downstream components process a different, normalized path.
- CVE-2026-42273High
Heimdall, an identity-aware proxy and access control service, prior to version 0.17.14, performed host matching in a case-sensitive manner, which is inconsistent with the fact that HTTP hostnames are case-insensitive. This can lead to misclassification of requests that differ only in letter casing.
Original NVD description (English source)
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS