Vulnerability-Lookup

OPENSUSE-SU-2026:12397-1

Vulnerability from csaf_opensuse - Published: 2026-11-03 00:00 - Updated: 2026-11-04 21:57

Summary

heimdall-2.2.2-1.1 on GA media

Severity

Moderate

Notes

Title of the patch: heimdall-2.2.2-1.1 on GA media

Description of the patch: These are all security issues fixed in the heimdall-2.2.2-1.1 package on the GA media of openSUSE Tumbleweed.

Patchnames: openSUSE-Tumbleweed-2026-12397

CVE-2026-57209

Affected products

Recommended 8 products

Product	Version	Remediation
Unresolved product id: openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x	—	Vendor Fix
Unresolved product id: openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2026-57210

Affected products

Recommended 8 products, the same list as for CVE-2026-57209

Threats

Impact moderate

References

8 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/o…	self
https://www.suse.com/security/cve/CVE-2026-57209/	self
https://www.suse.com/security/cve/CVE-2026-57210/	self
https://www.suse.com/security/cve/CVE-2026-57209	external
https://bugzilla.suse.com/1271956	external
https://www.suse.com/security/cve/CVE-2026-57210	external
https://bugzilla.suse.com/1271957	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "heimdall-2.2.2-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the heimdall-2.2.2-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12397",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12397-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-57209 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-57209/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-57210 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-57210/"
      }
    ],
    "title": "heimdall-2.2.2-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-11-04T21:57:25Z",
      "generator": {
        "date": "2026-11-03T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12397-1",
      "initial_release_date": "2026-11-03T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-11-03T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-11-04T21:57:25Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heimdall-0:2.2.2-1.1.aarch64",
                "product": {
                  "name": "heimdall-0:2.2.2-1.1.aarch64",
                  "product_id": "heimdall-0:2.2.2-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall@2.2.2-1.1?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "heimdall-frontend-0:2.2.2-1.1.aarch64",
                "product": {
                  "name": "heimdall-frontend-0:2.2.2-1.1.aarch64",
                  "product_id": "heimdall-frontend-0:2.2.2-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall-frontend@2.2.2-1.1?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heimdall-0:2.2.2-1.1.ppc64le",
                "product": {
                  "name": "heimdall-0:2.2.2-1.1.ppc64le",
                  "product_id": "heimdall-0:2.2.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall@2.2.2-1.1?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "heimdall-frontend-0:2.2.2-1.1.ppc64le",
                "product": {
                  "name": "heimdall-frontend-0:2.2.2-1.1.ppc64le",
                  "product_id": "heimdall-frontend-0:2.2.2-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall-frontend@2.2.2-1.1?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heimdall-0:2.2.2-1.1.s390x",
                "product": {
                  "name": "heimdall-0:2.2.2-1.1.s390x",
                  "product_id": "heimdall-0:2.2.2-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall@2.2.2-1.1?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "heimdall-frontend-0:2.2.2-1.1.s390x",
                "product": {
                  "name": "heimdall-frontend-0:2.2.2-1.1.s390x",
                  "product_id": "heimdall-frontend-0:2.2.2-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall-frontend@2.2.2-1.1?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "heimdall-0:2.2.2-1.1.x86_64",
                "product": {
                  "name": "heimdall-0:2.2.2-1.1.x86_64",
                  "product_id": "heimdall-0:2.2.2-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall@2.2.2-1.1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "heimdall-frontend-0:2.2.2-1.1.x86_64",
                "product": {
                  "name": "heimdall-frontend-0:2.2.2-1.1.x86_64",
                  "product_id": "heimdall-frontend-0:2.2.2-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/heimdall-frontend@2.2.2-1.1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-0:2.2.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64"
        },
        "product_reference": "heimdall-0:2.2.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-0:2.2.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le"
        },
        "product_reference": "heimdall-0:2.2.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-0:2.2.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x"
        },
        "product_reference": "heimdall-0:2.2.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-0:2.2.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64"
        },
        "product_reference": "heimdall-0:2.2.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-frontend-0:2.2.2-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64"
        },
        "product_reference": "heimdall-frontend-0:2.2.2-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-frontend-0:2.2.2-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le"
        },
        "product_reference": "heimdall-frontend-0:2.2.2-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-frontend-0:2.2.2-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x"
        },
        "product_reference": "heimdall-frontend-0:2.2.2-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "heimdall-frontend-0:2.2.2-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64"
        },
        "product_reference": "heimdall-frontend-0:2.2.2-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-57209",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-57209"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request\u0027s Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-57209",
          "url": "https://www.suse.com/security/cve/CVE-2026-57209"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271956 for CVE-2026-57209",
          "url": "https://bugzilla.suse.com/1271956"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-57209"
    },
    {
      "cve": "CVE-2026-57210",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-57210"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments - including trailing quote characters - treated as independent addresses. This issue has been patched in version 0.17.17.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x",
          "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x",
          "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-57210",
          "url": "https://www.suse.com/security/cve/CVE-2026-57210"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1271957 for CVE-2026-57210",
          "url": "https://bugzilla.suse.com/1271957"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.aarch64",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.ppc64le",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.s390x",
            "openSUSE Tumbleweed:heimdall-0:2.2.2-1.1.x86_64",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.aarch64",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.ppc64le",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.s390x",
            "openSUSE Tumbleweed:heimdall-frontend-0:2.2.2-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-11-03T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-57210"
    }
  ]
}

CVE-2026-57209 (GCVE-0-2026-57209)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:27 – Updated: 2026-10-29 13:16

Title

Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

Summary

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

Severity

7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 13:15 UTC

CWE

CWE-20 - Improper Input Validation
CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8074 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/dadrus/heimdall/security/advis…	x_refsource_CONFIRM
https://github.com/dadrus/heimdall/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dadrus	heimdall	Affected: < 0.17.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57209",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T13:15:43.399575Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T13:16:52.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "heimdall",
          "vendor": "dadrus",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.17.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request\u0027s Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:27:19.621Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988"
        },
        {
          "name": "https://github.com/dadrus/heimdall/releases/tag/v0.17.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dadrus/heimdall/releases/tag/v0.17.17"
        }
      ],
      "source": {
        "advisory": "GHSA-4jgr-pg2m-m988",
        "discovery": "UNKNOWN"
      },
      "title": "Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57209",
    "datePublished": "2026-10-23T12:27:19.621Z",
    "dateReserved": "2026-06-24T02:00:46.801Z",
    "dateUpdated": "2026-10-29T13:16:52.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57210 (GCVE-0-2026-57210)

Vulnerability from cvelistv5 – Published: 2026-10-23 12:28 – Updated: 2026-10-29 02:57

Title

Heimdall: IP Spoofing via Unvalidated Forwarding Headers

Summary

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.

Severity

7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-29 02:57 UTC

CWE

CWE-20 - Improper Input Validation
CWE-116 - Improper Encoding or Escaping of Output
CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 8074 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/dadrus/heimdall/security/advis…	x_refsource_CONFIRM
https://github.com/dadrus/heimdall/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
dadrus	heimdall	Affected: < 0.17.17

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57210",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T02:57:03.506476Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T02:57:12.693Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "heimdall",
          "vendor": "dadrus",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.17.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments \u2014 including trailing quote characters \u2014 treated as independent addresses. This issue has been patched in version 0.17.17."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116: Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-23T12:28:09.427Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2"
        },
        {
          "name": "https://github.com/dadrus/heimdall/releases/tag/v0.17.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/dadrus/heimdall/releases/tag/v0.17.17"
        }
      ],
      "source": {
        "advisory": "GHSA-38x9-25wx-7fg2",
        "discovery": "UNKNOWN"
      },
      "title": "Heimdall: IP Spoofing via Unvalidated Forwarding Headers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-57210",
    "datePublished": "2026-10-23T12:28:09.427Z",
    "dateReserved": "2026-06-24T02:00:46.801Z",
    "dateUpdated": "2026-10-29T02:57:12.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OPENSUSE-SU-2026:12397-1

CVE-2026-57209 (GCVE-0-2026-57209)

CVE-2026-57210 (GCVE-0-2026-57210)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour