CVE-2026-42274: Heimdall Auth Bypass Vulnerability

CVE-2026-42274 Overview

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. CVE-2026-42274 is a path normalization inconsistency vulnerability affecting Heimdall versions prior to 0.17.14. The flaw allows attackers to bypass access control rules by exploiting differences in how Heimdall and downstream services interpret request paths. Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments per RFC 3986 Section 6.2.2.3. This discrepancy can result in authorization decisions being made against one path while the downstream service processes a different, normalized path. The issue is tracked under [CWE-35] (Path Traversal: .../...//).

Critical Impact
Attackers can bypass Heimdall access control decisions and reach protected downstream endpoints such as /admin by submitting paths containing dot-segments or URL-encoded variants.

Affected Products

Heimdall versions prior to 0.17.14
Deployments using Heimdall as an Identity Aware Proxy in front of downstream services
Configurations where downstream services normalize dot-segments per RFC 3986

Discovery Timeline

2026-05-08 - CVE-2026-42274 published to NVD
2026-05-08 - Last updated in NVD database
Version 0.17.14 - Patch released via GitHub Release v0.17.14 and GitHub Security Advisory GHSA-3q34-rx83-r6mq

Technical Details for CVE-2026-42274

Vulnerability Analysis

Heimdall acts as an Identity Aware Proxy that evaluates access control rules before requests reach downstream services. The vulnerability exists because Heimdall matches rules against the raw request path without applying RFC 3986 dot-segment normalization. Downstream services such as reverse proxies and application servers commonly normalize paths before routing.

An attacker can craft a request to a path like /user/../admin that Heimdall matches against rules defined for /user/*. The downstream service then normalizes the path to /admin and serves the protected resource. URL-encoded variants like /user/%2e%2e/admin produce the same bypass. Encoded slash variants such as /user/%2e%2e%2fadmin work when the downstream allow_encoded_slashes option is set to on or no_decode.

Root Cause

The root cause is an inconsistency between path interpretation layers. Heimdall's rule engine evaluates the literal request path string while downstream components apply RFC 3986 Section 6.2.2.3 path segment normalization. This violates the principle that authorization decisions must be made against the same canonical form the resource handler uses.

Attack Vector

Exploitation requires only network access and no authentication. An attacker sends an HTTP request with dot-segments or encoded variants in the path. Heimdall evaluates the rule for the surface path, grants the request, and forwards it. The downstream component resolves the dot-segments and processes a different protected endpoint.

text

# Example bypass request patterns (sanitized)
GET /user/../admin HTTP/1.1
GET /user/%2e%2e/admin HTTP/1.1
GET /user/%2e%2e%2fadmin HTTP/1.1   # requires allow_encoded_slashes=on|no_decode

The fix in commit b5dfa484b7a8c2ce6d8691c026f9da867719947a normalizes the request path before rule evaluation. See the GitHub Commit Change and GitHub Pull Request #3209 for details.

Detection Methods for CVE-2026-42274

Indicators of Compromise

HTTP requests containing .. dot-segments in the URL path forwarded through Heimdall
Requests with URL-encoded traversal sequences such as %2e%2e, %2e%2e%2f, or %2e%2e/
Access log entries showing successful responses for sensitive endpoints (e.g., /admin) reached via paths matching less privileged rules
Discrepancies between Heimdall decision logs (matched rule path) and downstream service access logs (resolved path)

Detection Strategies

Enable debug level logging in Heimdall to capture matched rule and request path for each decision
Correlate Heimdall authorization decisions with downstream access logs on the resolved path
Apply web application firewall signatures that flag dot-segment and encoded-traversal sequences in request URIs
Monitor for unauthorized access patterns to administrative or privileged endpoints behind Heimdall

Monitoring Recommendations

Centralize Heimdall and downstream access logs in a SIEM and alert on path mismatches between authorization and execution layers
Track request volume containing %2e, %2f, and .. patterns across the proxy fleet
Alert on successful HTTP 2xx responses to administrative paths originating from unauthenticated or low-privilege sessions

How to Mitigate CVE-2026-42274

Immediate Actions Required

Upgrade Heimdall to version 0.17.14 or later, which normalizes the request path before rule evaluation
Audit Heimdall rule definitions to confirm that path-based access control matches the canonical form used by downstream services
Review historical access logs for evidence of traversal-style requests reaching protected endpoints
Restrict the allow_encoded_slashes setting on downstream components unless explicitly required

Patch Information

The vulnerability is patched in Heimdall 0.17.14. The fix is implemented in commit b5dfa484b7a8c2ce6d8691c026f9da867719947a via GitHub Pull Request #3209. Refer to the GitHub Security Advisory GHSA-3q34-rx83-r6mq for full advisory details and the GitHub Release v0.17.14 for upgrade artifacts.

Workarounds

Deploy a front-line reverse proxy or WAF that performs RFC 3986 path normalization before traffic reaches Heimdall
Reject requests containing .. segments and encoded traversal sequences (%2e%2e, %2e%2e%2f) at the edge
Disable allow_encoded_slashes on downstream services to reduce the encoded-slash variant attack surface
Define deny-by-default rules in Heimdall for administrative paths and require explicit allow rules

bash

# Example: upgrade Heimdall container image to the patched release
docker pull dadrus/heimdall:v0.17.14

# Example: edge WAF/nginx rule to block traversal sequences before Heimdall
# (place in the front-line proxy that fronts Heimdall)
if ($request_uri ~* "(\.\./|%2e%2e/|%2e%2e%2f|/\.\.)") {
    return 400;
}