CVE-2026-42272: fallo de gravedad alta en dadrus heimdall
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.4%
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Productos afectados
dadrus · heimdallCVEs relacionadas — dadrus heimdall
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-57209HIGHHeimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy ModeEPSS 0.5%CVE-2026-42274HIGHHeimdall: Authorization bypass via path normalization mismatchEPSS 0.4%CVE-2026-32811HIGHHeimdall: Path received via Envoy gRPC corrupted when containing query stringEPSS 0.3%CVE-2026-57210HIGHHeimdall: IP Spoofing via Unvalidated Forwarding HeadersEPSS 0.3%CVE-2026-42273HIGHHeimdall: Case-sensitive host matching may lead to policy bypassEPSS 0.3%