CVE-2026-57209
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Heimdall proxy mode, the Forwarded HTTP header is constructed by inserting the incoming Host header value without sanitizing commas or semicolons. An attacker can inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. The issue is patched in version 0.17.17.
Risk Assessment
IP spoofing can bypass access control mechanisms and falsify logs in upstream services. This may lead to unauthorized access or incorrect security decisions.
Recommendation
Update Heimdall to version 0.17.17 or later. Until patched, consider restricting proxy mode or validating Forwarded headers on upstream services.
Other vulnerabilities in Heimdall
See all- CVE-2026-57210High
In Heimdall, when trusted_proxies is configured, client IP addresses are extracted from Forwarded and X-Forwarded-For headers and exposed as Request.ClientIPAddresses without syntactic validation. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values are accepted, and the Forwarded header parser mishandles quoted strings, potentially parsing a single value as multiple entries. The issue is patched in version 0.17.17.
- CVE-2026-107449Low
linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection only to ItemController; the enhanced-application test and live-stats requests occur via SupportedApps::execute(), a GuzzleHttp client that lacks IP address restrictions. In some realistic installations, the POST /test_config (and GET /get_stats) endpoints are accessible through CSRF, allowing an unauthenticated attacker to force the server to send requests to arbitrary internal hosts and ports (including 169.254.169.254) and read a status/port oracle in addition to partial response data.
- CVE-2026-82477Medium
In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.
- CVE-2026-42274High
Heimdall prior to version 0.17.14 performs rule matching on the raw request path, which may lead to unauthorized access. Due to the discrepancy in path normalization, Heimdall may authorize requests for one path while downstream components process a different, normalized path.
- CVE-2026-42273High
Heimdall, an identity-aware proxy and access control service, prior to version 0.17.14, performed host matching in a case-sensitive manner, which is inconsistent with the fact that HTTP hostnames are case-insensitive. This can lead to misclassification of requests that differ only in letter casing.
- CVE-2026-42272High
Heimdall, a proxy and access control service, prior to version 0.17.14 handled URL-encoded slashes in a case-sensitive manner, leading to request path interpretation issues. As a result, the lowercase equivalent (%2f) was not recognized, potentially resulting in authorization bypass.
Original NVD description (English source)
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS