All vulnerabilities
CVE-2026-57209GHSA-4jgr-pg2m-m988GO-2026-5125

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

dadrus heimdallGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.17.17Fixed versionOSV
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 0.17.17github.com/dadrus/heimdall, GoOSVgo get github.com/dadrus/heimdall@v0.17.17

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

Text from CVE List

Affected versions 2

  • heimdallaffected: < 0.17.17CVE List
  • github.com/dadrus/heimdall, Gofrom first release, fixed in 0.17.17OSV

References 2