{"id":"CVE-2026-57209","revision":null,"records":[{"revision":"a2f75595b8bd4b2aacd0a89c3383603a","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-57209","aliases":[],"title":"Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.","state":0,"publishedAt":"2026-10-23T12:27:19.621+00:00","modifiedAt":"2026-10-23T12:27:19.621+00:00","affected":[{"ecosystem":"Vendor product","name":"heimdall","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dadrus\",\n                    \"product\": \"heimdall\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.17.17\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988","https://github.com/dadrus/heimdall/releases/tag/v0.17.17"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-57209","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-57209","identifiers":["CVE-2026-57209"]},"retained":false,"historicalAffected":[]},{"revision":"02ee5240617e4e93809b5fb16f67fefa","observedAt":"2026-10-25T14:19:10.848+00:00","statement":{"source":"nvd","id":"CVE-2026-57209","aliases":[],"title":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by insert…","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.","state":0,"publishedAt":"2026-10-23T13:17:11.687+00:00","modifiedAt":"2026-10-23T19:57:42.66+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/releases/tag/v0.17.17","https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57209","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20","CWE-74"],"productCriteria":[],"sourceDates":{"published":"2026-10-23T13:17:11.687","lastModified":"2026-10-23T19:57:42.660"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-57209","identifiers":["CVE-2026-57209"]},"retained":false,"historicalAffected":[]},{"revision":"599cdbe62eb84426b80bf3d0e0eb24b3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4jgr-pg2m-m988","aliases":["CVE-2026-57209","GO-2026-5125"],"title":"Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode","description":"### Summary\n\nWhen Heimdall operates in proxy mode, it constructs the `Forwarded` HTTP header after executing the matched rule pipeline by inserting the incoming request's `Host` header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the `Forwarded` header, potentially spoofing IP addresses for upstream services.\n\n### Vulnerable Code\n\n**File: `proxy/request_context.go` (line 201)**\n\n```go\nentry := \"for=\" + clientIP + \";host=\" + in.Host + \";proto=\" + proto\n```\n\nGo's `net/http` allows commas and semicolons in Host header values. No sanitization is applied before string concatenation.\n\n### PoC\n\n```bash\n# Inject a spoofed IP into the Forwarded header\ncurl -s -H \"Host: evil.com,for=127.0.0.1\" \\\n  \"http://TARGET:PORT/protected-resource\"\n```\n\nThis produces the following `Forwarded` header sent to the upstream service:\n\n```\nForwarded: for=1.2.3.4;host=evil.com, for=127.0.0.1;proto=http\n```\n\nUpstream services that parse the `Forwarded` header according to RFC 7239 will see two entries. If the service trusts the last or any `for=` value, the attacker successfully spoofs `127.0.0.1` as the client IP.\n\n```bash\n# More targeted attack: spoof to bypass IP allowlist\ncurl -s -H \"Host: legit.com;for=10.0.0.1;proto=https,for=192.168.1.1\" \\\n  \"http://TARGET:PORT/admin-panel\"\n```\n\n### Impact\n\n- **IP spoofing:** Upstream services behind Heimdall may trust the injected `for=` value, believing the request originates from an internal/trusted IP\n- **Access control bypass:** Applications that restrict access based on IP address by themselves, without using the corresponding heimdall capabilities (e.g., admin panels, internal APIs), can be bypassed\n- **Affects all proxy-mode deployments** where upstream services parse the `Forwarded` header.","state":0,"publishedAt":"2026-06-18T14:24:41+00:00","modifiedAt":"2026-07-20T21:56:16.5669993+00:00","affected":[{"ecosystem":"Go","name":"github.com/dadrus/heimdall","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988","https://github.com/dadrus/heimdall"],"sourceUrl":"https://github.com/advisories/GHSA-4jgr-pg2m-m988","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4jgr-pg2m-m988","identifiers":["GHSA-4jgr-pg2m-m988","CVE-2026-57209","GO-2026-5125"]},"retained":false,"historicalAffected":[]},{"revision":"19f6218fffa644948e041bcae3746000","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5125","aliases":["CVE-2026-57209","GHSA-4jgr-pg2m-m988"],"title":"Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall","description":"Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-07-20T21:56:16.5669993+00:00","affected":[{"ecosystem":"Go","name":"github.com/dadrus/heimdall","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5125","license":"OSV · upstream source license applies","key":"osv:GO-2026-5125","identifiers":["GO-2026-5125","CVE-2026-57209","GHSA-4jgr-pg2m-m988"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T11:11:56.6678062+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T11:11:56.6678062+00:00","lastSuccessAt":"2026-10-27T11:11:56.8243728+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:11:56.8243749+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-9f7402126dc5529a1b08865d811f13ed8c445867d9a45d41761dcc621011842e","complete":true,"records":414919,"lastAttemptAt":"2026-10-27T11:09:37.0832785+00:00","lastSuccessAt":"2026-10-27T11:09:37.0305451+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:09:37.0832785+00:00","snapshotPublishedAt":"2026-10-27T10:30:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T11:12:26.0342942+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13480},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T11:11:56.6678062+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T11:11:56.6678062+00:00","lastSuccessAt":"2026-10-27T11:11:56.8252029+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:11:56.8252036+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c6c2b354cca8400a8af7dee419d3a5e5","complete":false,"records":13419,"lastAttemptAt":"2026-10-27T11:12:23.9234765+00:00","lastSuccessAt":"2026-10-27T11:12:23.919+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:12:23.919+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13477,"expectedIdentifiers":13480},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T11:11:51.9998316+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:11:51.9998316+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T11:09:37.2374562+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:09:37.2374562+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-112103ad2640f03b274c0e731c3f4398f99b844297f2e68d520aeec5561d6df2","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T11:11:56.6249674+00:00","lastSuccessAt":"2026-10-27T11:11:56.4872351+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:11:56.6249674+00:00","snapshotPublishedAt":"2026-10-27T10:33:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-004e8284b6ea6365b51ff4b74ec6be79d1edd4a5cab2e56b5baf5b4428e96986","complete":true,"records":230813,"lastAttemptAt":"2026-10-27T11:11:51.8474073+00:00","lastSuccessAt":"2026-10-27T11:11:50.4927963+00:00","error":null,"lastVerifiedAt":"2026-10-27T11:11:51.8474073+00:00","snapshotPublishedAt":"2026-10-27T11:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}