CVE-2026-42273: Heimdall Auth Bypass Vulnerability

CVE-2026-42273 Overview

CVE-2026-42273 is an access control bypass vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service. Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive per RFC 3986, Section 3.2.2. The discrepancy allows a request whose Host header differs only in letter casing to be classified differently than intended, bypassing the matched rule. The flaw is categorized as [CWE-178] (Improper Handling of Case Sensitivity) and is fixed in Heimdall version 0.17.14.

Critical Impact
Attackers can manipulate the casing of HTTP Host headers to evade Heimdall rule matching, potentially bypassing identity-aware access control decisions for protected upstream services.

Affected Products

Heimdall versions prior to 0.17.14
Deployments using exact or wildcard host matchers in rule definitions
Heimdall instances integrated as an external authorization service with Envoy (envoyextauth/grpcv3)

Discovery Timeline

2026-05-08 - CVE-2026-42273 published to NVD
2026-05-08 - Last updated in NVD database

Technical Details for CVE-2026-42273

Vulnerability Analysis

Heimdall evaluates incoming requests against rules that include hosts matchers to determine which access control policy to apply. Prior to 0.17.14, the matcher compared the incoming HTTP Host value byte-for-byte against the configured expressions. Because HTTP and URI specifications define the host component as case-insensitive, two semantically equivalent hosts such as api.example.com and API.Example.com were treated as distinct strings during rule lookup.

When no rule matched the cased variant, the request was classified differently than the administrator intended. Depending on the configured default behavior or alternate rule chain, this could result in the request bypassing authentication, authorization, or transformation logic that would otherwise apply. The issue affects deployments where rules are written with mixed or lowercase host expressions and clients can control the casing of the Host header.

Root Cause

The root cause is normalization inconsistency between the protocol specification and Heimdall's matching logic. Heimdall did not lowercase the incoming Host header before evaluating it against exact and wildcard host expressions, and did not normalize those expressions either. This violates the case-insensitivity requirement of RFC 3986, Section 3.2.2 for the host component of a URI.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to a Heimdall-protected service with a Host header that differs only in letter casing from the configured rule. Heimdall fails to associate the request with the intended rule, causing the access control decision to diverge from the administrator's policy. The patch in commit 3d05e56 normalizes the incoming host to lowercase before rule lookup.

// Patch: internal/handler/envoyextauth/grpcv3/request_context.go
	r.hmdlReq.Method = httpReq.GetMethod()
	r.hmdlReq.URL.URL = url.URL{
		Scheme:   httpReq.GetScheme(),
-		Host:     httpReq.GetHost(),
+		Host:     strings.ToLower(httpReq.GetHost()),
		RawPath:  parsed.RawPath,
		Path:     parsed.Path,
		RawQuery: parsed.RawQuery,
	}
+	r.reqHeaders["Host"] = r.hmdlReq.URL.Host
	r.hmdlReq.ClientIPAddresses = clientIPs

Source: GitHub Commit 3d05e56

Detection Methods for CVE-2026-42273

Indicators of Compromise

HTTP requests reaching upstream services with Host header values containing uppercase characters that do not match any documented configuration entry.
Heimdall access logs showing rule lookup misses or default-rule application for hosts that should match a defined rule.
Discrepancies between configured hosts expressions and observed traffic casing on protected endpoints.

Detection Strategies

Audit Heimdall rule definitions for exact and wildcard host expressions and confirm they are written in lowercase.
Compare rule-match telemetry against upstream service request logs to identify requests that bypassed expected matchers.
Replay representative traffic with permuted host-header casing in a test environment and verify the same rule fires.

Monitoring Recommendations

Forward Heimdall decision logs to a centralized analytics platform and alert on unexpected rule fallthrough for known protected hostnames.
Track Heimdall version metadata across deployments to surface instances running versions earlier than 0.17.14.
Monitor inbound request distributions for unusual Host header casing patterns originating from a small set of source IPs.

How to Mitigate CVE-2026-42273

Immediate Actions Required

Upgrade Heimdall to version 0.17.14 or later, as published in the v0.17.14 release notes.
Review all hosts matchers in rule sets and convert exact and wildcard expressions to lowercase.
Validate glob and regex host expressions for case sensitivity and rewrite them in lowercase where appropriate.

Patch Information

The fix is delivered in Heimdall 0.17.14 via pull request #3208 and commit 3d05e56a9e7ef0355f17482b4322054af4e85943. The patch normalizes the incoming request host to lowercase before rule lookup, normalizes exact and wildcard host expressions to lowercase, and documents that glob and regex expressions are evaluated as configured. Full details are available in the GHSA-72h4-mxfc-jx37 advisory.

Workarounds

If immediate upgrade is not possible, rewrite all exact and wildcard host expressions in lowercase and place an upstream proxy that lowercases the Host header before forwarding to Heimdall.
Add a defensive catch-all rule that denies requests when no explicit host match is found, preventing implicit fallthrough.
Restrict ingress so that only normalized traffic from a trusted reverse proxy reaches Heimdall.

bash

# Example: verify Heimdall version and locate non-lowercase host expressions
heimdall --version
grep -RInE 'hosts:|value:' /etc/heimdall/rules/ | grep -E '[A-Z]'