{"id":"EUVD-2026-28510","enisaUuid":"e1164be0-ad1a-3ff3-b746-b8dc6c605b34","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.","datePublished":"May 8, 2026, 3:43:41 AM","dateUpdated":"May 11, 2026, 6:20:15 PM","baseScore":7.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq\nhttps://github.com/dadrus/heimdall/pull/3209\nhttps://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\n","aliases":"CVE-2026-42274\nGHSA-3q34-rx83-r6mq\n","assigner":"GitHub_M","epss":0.37,"enisaIdProduct":[{"id":"9336149f-fcbf-30b4-baf2-11dc900172f0","product":{"name":"Heimdall","vendor":{"name":"dadrus"}},"product_version":"\u003c 0.17.14"}],"enisaIdVendor":[{"id":"f83d155e-23a4-3da0-bc56-949ab42ddfdb","vendor":{"name":"dadrus"}}],"enisaIdVulnerability":[{"id":"7b0c7db8-d774-338a-9f1f-ebff4091cf72","vulnerability":{"id":"GHSA-3q34-rx83-r6mq","description":"Heimdall has an authorization bypass via path normalization mismatch","datePublished":"Apr 25, 2026, 11:30:46 PM","dateUpdated":"May 12, 2026, 1:29:02 PM","baseScore":0.0,"references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42274\nhttps://github.com/dadrus/heimdall/pull/3209\nhttps://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a\nhttps://github.com/dadrus/heimdall\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\nhttps://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto#envoy-v3-api-field-extensions-filters-network-http-connection-manager-v3-httpconnectionmanager-normalize-path\nhttps://www.rfc-editor.org/rfc/rfc3986#section-6.2.2.3\n","enisa_id":"EUVD-2026-28510\n","aliases":"GHSA-3q34-rx83-r6mq\nCVE-2026-42274\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d86db59d-edc2-3912-8ca3-87e3776b79cf","vulnerability":{"id":"CVE-2026-42274","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.","datePublished":"May 8, 2026, 3:43:41 AM","dateUpdated":"May 11, 2026, 6:20:15 PM","status":"PUBLISHED","baseScore":7.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq\nhttps://github.com/dadrus/heimdall/pull/3209\nhttps://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\n","enisa_id":"EUVD-2026-28510\n","assigner":"GitHub_M","epss":0.37,"dataProcessed":"Oct 30, 2026, 7:17:17 AM","vulnerabilityProduct":[{"id":"6a46dc02-8991-3fd5-bc49-df5980930397","product":{"name":"Heimdall","vendor":{"name":"dadrus"}},"product_version":"\u003c 0.17.14"}],"vulnerabilityVendor":[{"id":"89dbc48b-50b9-32fd-a495-eb094c55a740","vendor":{"name":"dadrus"}}]}}],"enisaIdAdvisory":[]}