PT-2026-37187 · Heimdal · Heimdal

Kakadus

·

Published

2026-04-25

·

Updated

2026-05-09

·

CVE-2026-42273

CVSS v4.0

7.8

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions Heimdall versions prior to 0.17.14
Description Heimdall performs host matching in a case-sensitive manner, which conflicts with the case-insensitive nature of HTTP hostnames. This discrepancy allows a request host that differs only in letter casing to fail rule matching, potentially causing the request to be classified differently than intended. If the service is configured with a permissive default rule—which may occur if secure defaults are disabled via the --insecure or --insecure-skip-secure-default-rule-enforcement flags—this can lead to a bypass of access control policies. Such a bypass may result in unauthorized access to restricted data, invocation of protected functionality, or privilege escalation.
Recommendations Update to version 0.17.14. Normalize request hosts to lowercase in the layers preceding Heimdall. Avoid configuring permissive default rules and refrain from using the --insecure or --insecure-skip-secure-default-rule-enforcement flags. When using regex for host matching, define expressions in a case-insensitive manner, such as (?i)^admin.example.com$. Include the expected rule ID in the JWT issued by Heimdall and verify this value within the consuming project's service.

Fix

Weakness Enumeration

CWE-178CWE-436

Related Identifiers

CVE-2026-42273
GHSA-72H4-MXFC-JX37

Affected Products

Heimdal