{"id":"GHSA-38x9-25wx-7fg2","revision":null,"records":[{"revision":"1d0a8a06a140400ead705cdc33a42090","observedAt":"2026-10-23T16:01:20.601+00:00","statement":{"source":"cve-program","id":"CVE-2026-57210","aliases":[],"title":"Heimdall: IP Spoofing via Unvalidated Forwarding Headers","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.","state":0,"publishedAt":"2026-10-23T12:28:09.427+00:00","modifiedAt":"2026-10-23T12:28:09.427+00:00","affected":[{"ecosystem":"Vendor product","name":"heimdall","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"dadrus\",\n                    \"product\": \"heimdall\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.17.17\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2","https://github.com/dadrus/heimdall/releases/tag/v0.17.17"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-57210","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-57210","identifiers":["CVE-2026-57210"]},"retained":false,"historicalAffected":[]},{"revision":"1531d5ab5ad44ace8550454f89b340cf","observedAt":"2026-10-25T14:19:16.843+00:00","statement":{"source":"nvd","id":"CVE-2026-57210","aliases":[],"title":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Fo…","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.","state":0,"publishedAt":"2026-10-23T13:17:11.847+00:00","modifiedAt":"2026-10-23T19:57:42.66+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/releases/tag/v0.17.17","https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-57210","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20","CWE-116","CWE-290"],"productCriteria":[],"sourceDates":{"published":"2026-10-23T13:17:11.847","lastModified":"2026-10-23T19:57:42.660"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-57210","identifiers":["CVE-2026-57210"]},"retained":false,"historicalAffected":[]},{"revision":"e15be7af0489435caac2164957937bc5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-38x9-25wx-7fg2","aliases":["CVE-2026-57210","GO-2026-5075"],"title":"Heimdall: IP Spoofing via Unvalidated Forwarding Headers","description":"### Summary\n\nWhen the `trusted_proxies` option is configured, heimdall extracts client IP addresses from the `Forwarded` (`for=` parameter) and `X-Forwarded-For` headers and exposes them as `Request.ClientIPAddresses` to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 `unknown` values and obfuscated identifiers are accepted without further checks.\nIn addition, the `Forwarded` header parser splits on `,` and `;` without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses.\n\n### Impact\n\n`Request.ClientIPAddresses` is available to all pipeline mechanisms. Its contents can therefore influence rule evaluation in deployments where rules reference this property — for example, in a `CEL` authorizer that checks whether a request originates from a trusted IP range using the `networks()` function, or in a `Remote` authorizer that forwards the client IP as part of its payload to an external authorization system. Whether and how `Request.ClientIPAddresses` is used is entirely determined by the rule configuration.\n\nAdditionally, in proxy mode, `Request.ClientIPAddresses` is used directly to construct the `X-Forwarded-For` and `Forwarded` headers forwarded to upstream services. Injected or malformed values are therefore propagated to upstream services unchanged.\n\n### Attack Scenarios\n\nAll scenarios require that `trusted_proxies` is configured. If this option is not set, heimdall ignores forwarding headers entirely, and this vulnerability is not exploitable. Scenarios A and C  (see below) additionally require that rules reference `Request.ClientIPAddresses` in their pipeline.\n\n#### Scenario A – Manipulation of rule evaluation\n\nAn attacker who can influence forwarding headers — either by connecting directly to heimdall or through a proxy that does not sanitize these headers — can inject arbitrary values into `Request.ClientIPAddresses`. In deployments where a rule references this property (e.g. to restrict access to specific IP ranges), this may allow an attacker to bypass the intended access control logic.\n\n#### Scenario B – IP spoofing against upstream services (proxy mode)\n\nIn proxy mode, injected or malformed values in `Request.ClientIPAddresses` are written unchanged into the `X-Forwarded-For` header sent to upstream services. Upstream services that trust this header may therefore receive and act on attacker-controlled IP values.\n\n#### Scenario C – Malformed entries via quoted-string misparse\n\nA `Forwarded` header containing a quoted value with embedded delimiters (`,` or `;`) is misparsed, producing unintended additional entries in `Request.ClientIPAddresses`, including malformed fragments with trailing quote characters.\n\n### Workarounds\n\n* Ensure at the network level that only trusted proxies can communicate directly with heimdall.\n* Ensure that the proxy forwarding the requests to heimdall sanitizes or overrides (not merely appends to) `Forwarded` or `X-Forwarded-For` headers before forwarding them.\n* Avoid relying on `Request.ClientIPAddresses` for security-sensitive decisions until patched","state":0,"publishedAt":"2026-06-18T14:24:37+00:00","modifiedAt":"2026-08-11T20:51:05.2511148+00:00","affected":[{"ecosystem":"Go","name":"https://github.com/dadrus/heimdall","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2","https://github.com/dadrus/heimdall"],"sourceUrl":"https://github.com/advisories/GHSA-38x9-25wx-7fg2","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-38x9-25wx-7fg2","identifiers":["GHSA-38x9-25wx-7fg2","CVE-2026-57210","GO-2026-5075"]},"retained":false,"historicalAffected":[]},{"revision":"da1268a9bdfe41e68f4a403d301fb819","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5075","aliases":["CVE-2026-57210","GHSA-38x9-25wx-7fg2"],"title":"Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall","description":"When the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on commas and semicolons without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments treated as independent addresses.\n\nRequest.ClientIPAddresses is available to all pipeline mechanisms. Its contents can therefore influence rule evaluation in deployments where rules reference this property. Additionally, in proxy mode, Request.ClientIPAddresses is used directly to construct the X-Forwarded-For and Forwarded headers forwarded to upstream services. Injected or malformed values are therefore propagated to upstream services unchanged.\n\nAn attacker who can influence forwarding headers can inject arbitrary values into Request.ClientIPAddresses. In deployments where a rule references this property, this may allow an attacker to bypass the intended access control logic. In proxy mode, upstream services that trust this header may receive and act on attacker-controlled IP values.","state":0,"publishedAt":"2026-08-11T20:19:48+00:00","modifiedAt":"2026-08-11T20:33:01.8487154+00:00","affected":[{"ecosystem":"Go","name":"github.com/dadrus/heimdall","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.17.17"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5075","license":"OSV · upstream source license applies","key":"osv:GO-2026-5075","identifiers":["GO-2026-5075","CVE-2026-57210","GHSA-38x9-25wx-7fg2"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T13:11:32.9438519+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T13:11:32.9438519+00:00","lastSuccessAt":"2026-10-27T13:11:33.1187394+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:33.1187411+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-196c2cb0807fad3a8d4b120ab79ac3a44cbe3ee6216cd49fad196396a5d89af8","complete":true,"records":414987,"lastAttemptAt":"2026-10-27T13:09:36.567907+00:00","lastSuccessAt":"2026-10-27T13:09:36.4997624+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:09:36.567907+00:00","snapshotPublishedAt":"2026-10-27T12:34:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T13:12:00.6692577+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13480},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T13:11:32.9438519+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T13:11:32.9438519+00:00","lastSuccessAt":"2026-10-27T13:11:33.1199434+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:33.1199441+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-6b97d67176ef495e8282107ed5295c50","complete":true,"records":13419,"lastAttemptAt":"2026-10-27T13:11:58.6799139+00:00","lastSuccessAt":"2026-10-27T13:11:58.676+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:58.676+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13480,"expectedIdentifiers":13480},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-c3121b113ecd88f1c92ccfa0ec9757ddc8386e4c12afd2597450b815744f800a","complete":true,"records":9779,"lastAttemptAt":"2026-10-27T13:11:32.5142588+00:00","lastSuccessAt":"2026-10-26T15:37:14.3083004+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:32.5142588+00:00","snapshotPublishedAt":"2026-10-26T14:48:41+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T13:09:36.713059+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:09:36.713059+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-112103ad2640f03b274c0e731c3f4398f99b844297f2e68d520aeec5561d6df2","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T13:11:32.9089952+00:00","lastSuccessAt":"2026-10-27T11:11:56.4872351+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:32.9089952+00:00","snapshotPublishedAt":"2026-10-27T10:33:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-374f329d6d1cee072b6ef0cbc5cb0b37d77cbe3f72a2c6f6cbcd0b5d16e77782","complete":true,"records":230814,"lastAttemptAt":"2026-10-27T13:11:32.3838963+00:00","lastSuccessAt":"2026-10-27T13:11:31.1250645+00:00","error":null,"lastVerifiedAt":"2026-10-27T13:11:32.3838963+00:00","snapshotPublishedAt":"2026-10-27T12:33:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}