heimdall vulnerabilities

6 known vulnerabilities in heimdall from Dadrus. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.

  CVE-2026-57210Oct 23, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers

• 7.0 High severity

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service.

  CVE-2026-57209Oct 23, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming req

• 7.8 High severity

  heimdall: Path Traversal: '.../...//'

  CVE-2026-42274May 8, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 398

• 7.8 High severity

  heimdall: Improper Handling of Case Sensitivity

  CVE-2026-42273May 8, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failin

• 7.8 High severity

  heimdall: Improper Handling of Case Sensitivity

  CVE-2026-42272May 8, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the low

• 7.5 High severity

  heimdall: Improper Encoding or Escaping of Output

  CVE-2026-32811Mar 20, 2026Dadrus

  Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. When using Heimdall in envoy gRPC decision API mode with versions 0.7.0-alpha through 0.17.10, wrong encoding of the query URL string allows rules with non-wildcard path expre