PT-2026-37188 · Heimdal · Heimdal
Dadrus
·
Published
2026-04-25
·
Updated
2026-05-09
·
CVE-2026-42274
CVSS v4.0
7.8
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Heimdall versions prior to 0.17.14
Description
Heimdall performs rule matching on the raw request path, whereas downstream components may normalize dot-segments according to RFC 3986. This discrepancy allows for the authorization of a request for one path (such as '/user/../admin' or URL-encoded variants like '/user/%2e%2e/admin') while the downstream service processes a different, normalized path (such as '/admin'). This can be exploited when rule matching uses wildcards without further constraints, potentially leading to the bypass of access control policies, unauthorized access to or modification of restricted data, invocation of protected functionality, or privilege escalation.
Recommendations
Update to version 0.17.14.
Normalize HTTP paths or reject paths containing relative path expressions in the layers preceding Heimdall.
Include the ID of the rule expected to be executed in the JWT issued by Heimdall and verify that value in the consuming project's service.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Heimdal