CVE-2026-42272: Heimdall Auth Bypass Vulnerability

CVE-2026-42272 Overview

CVE-2026-42272 is an authorization bypass vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service. Heimdall handles URL-encoded slashes in a case-sensitive manner, while the percent-encoding specification defines such encodings as case-insensitive. The lowercase variant %2f is not recognized when allow_encoded_slashes is set to off, which is the default configuration. Attackers can craft request paths that Heimdall and upstream components interpret differently, leading to authorization decisions being bypassed. The issue is patched in version 0.17.14 and is tracked under [CWE-178: Improper Handling of Case Sensitivity].

Critical Impact
Remote, unauthenticated attackers can bypass access control decisions by submitting request paths containing the lowercase %2f sequence, reaching upstream resources that Heimdall is meant to protect.

Affected Products

Heimdall Identity Aware Proxy versions prior to 0.17.14
Deployments using the default allow_encoded_slashes: off configuration
Upstream services protected by Heimdall access control rules

Discovery Timeline

2026-05-08 - CVE-2026-42272 published to the National Vulnerability Database
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-42272

Vulnerability Analysis

The vulnerability stems from inconsistent URL normalization between Heimdall and the upstream services it protects. Heimdall performs case-sensitive comparison against the encoded slash sequence %2F when evaluating route-matching rules. RFC 3986 mandates that percent-encoded triplets are case-insensitive, so %2f and %2F represent the same character. Attackers exploiting this discrepancy can produce a request path that Heimdall classifies as not matching a protected rule, while the upstream component normalizes both encodings identically and serves the protected resource.

The defect resides in the rule evaluation logic implemented in internal/rules/route_matcher.go and internal/rules/rule_impl.go. Both files previously relied on the standard library net/url and basic strings comparisons, neither of which normalize the case of percent-encoded characters before matching.

Root Cause

The root cause is improper handling of case sensitivity in URL decoding [CWE-178]. Heimdall's path-matching logic treats %2F and %2f as distinct sequences. When allow_encoded_slashes is off, the matcher rejects only the uppercase form, allowing requests with %2f to slip through without proper authorization evaluation.

Attack Vector

An unauthenticated network attacker submits an HTTP request to a Heimdall-protected endpoint and replaces literal / characters in path segments with %2f. Heimdall fails to associate the request with the relevant rule and forwards it upstream. The upstream service decodes %2f to / and serves the protected resource, completing the authorization bypass.

// Source: https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
// Patch in internal/rules/route_matcher.go — replaces direct net/url usage
// with a new internal package that performs case-insensitive percent-decoding.
 import (
 	"errors"
 	"net/http"
-	"net/url"
 	"slices"
 	"strings"
 
 	"github.com/dadrus/heimdall/internal/heimdall"
 	"github.com/dadrus/heimdall/internal/rules/config"
 	"github.com/dadrus/heimdall/internal/x/errorchain"
 	"github.com/dadrus/heimdall/internal/x/slicex"
+	"github.com/dadrus/heimdall/internal/x/urlx"
 )

The parallel change in internal/rules/rule_impl.go swaps strings-based comparison for the new urlx helper, ensuring rule evaluation normalizes encoded slashes regardless of hexadecimal case. See the GitHub Pull Request 3207 for the full diff.

Detection Methods for CVE-2026-42272

Indicators of Compromise

HTTP access logs containing %2f (lowercase) within request path segments targeting Heimdall-protected routes
Successful upstream responses for paths that Heimdall did not produce an explicit allow decision for
Discrepancies between Heimdall decision logs and upstream access logs for the same request ID

Detection Strategies

Compare normalized request paths between Heimdall and upstream services and alert on mismatches in routing decisions
Inspect request URIs for mixed-case percent-encoded sequences such as %2f, %2F, %2e, and %5c and treat them as suspicious when targeting authenticated endpoints
Audit Heimdall rule evaluation logs for requests classified as "no matching rule" that still receive HTTP 200 responses upstream

Monitoring Recommendations

Forward Heimdall and reverse proxy access logs to a centralized log platform and correlate authorization decisions with upstream responses
Establish baseline metrics for encoded-character frequency in request paths and alert on sudden increases
Monitor GitHub for further advisories on the dadrus/heimdall repository and subscribe to release notifications

How to Mitigate CVE-2026-42272

Immediate Actions Required

Upgrade Heimdall to version 0.17.14 or later, which contains the case-insensitive decoding fix
Audit existing access control rules to confirm coverage for paths that legitimately contain encoded slashes
Review historical access logs for requests containing %2f that reached protected upstream endpoints

Patch Information

The fix is included in Heimdall release v0.17.14 and delivered through commit 8b0de6a. The patch introduces an internal urlx package that performs case-insensitive percent-decoding before route matching. Full technical context is available in the GitHub Security Advisory GHSA-43jv-5j4x-qv67.

Workarounds

Set allow_encoded_slashes to on or no_decode if the deployment can tolerate it, and re-evaluate rule definitions to cover both encoded and decoded path forms
Deploy an upstream web application firewall rule that rejects requests containing %2f or %2F in path segments where literal slashes are not expected
Normalize percent-encoded sequences to uppercase at the network edge before requests reach Heimdall

bash

# Verify the running Heimdall version and upgrade via container image
docker pull dadrus/heimdall:0.17.14
docker run --rm dadrus/heimdall:0.17.14 version

# Example WAF rule (ModSecurity) to block lowercase %2f in path
SecRule REQUEST_URI "@rx %2[fF]" \
    "id:1042272,phase:1,deny,status:400,msg:'Encoded slash in path - CVE-2026-42272'"