CVE-2026-42274 json
Heimdall: Authorization bypass via path normalization mismatch
published 2026-04-25 6 mo ago modified 2026-10-26 13 d ago also EUVD-2026-28510 , GHSA-3q34-rx83-r6mq , GO-2026-5097
- cvss
- 7.8
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
Patch / fix
- go github.com/dadrus/heimdall 0.17.14
- dadrus heimdall 0.17.14
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/dadrus/heimdall@b5dfa48 commit
- github.com/dadrus/heimdall#3209 pull request
- github.com/dadrus/heimdall/releases/tag/v0.17.14 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N |
| CNA | 4.0 | 7.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/dadrus/heimdall | <0.17.14 |
0.17.14 |
Affected products
- dadrus heimdall
Classification
References
-
github.com
/dadrus/heimdall/pull/3209
web, patch
-
github.com
/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a
web, patch
-
github.com
/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq
web, advisory
-
github.com
/dadrus/heimdall/releases/tag/v0.17.14
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-42274
advisory
-
github.com
/dadrus/heimdall
package
-
envoyproxy.io
/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#
web
-
rfc-editor.org
/rfc/rfc3986#section-6.2.2.3
web
Sources
- CVE List CVE-2026-42274
- GitHub Advisory GHSA-3q34-rx83-r6mq
- NVD CVE-2026-42274
- OSV GO-2026-5097
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.