Vulnerability Description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Related Weaknesses (CWE)
References
- https://github.com/dadrus/heimdall/releases/tag/v0.17.17
- https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2
FAQ
What is CVE-2026-57210?
CVE-2026-57210 is a documented vulnerability. Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from...
How severe is CVE-2026-57210?
CVSS scoring is not yet available for CVE-2026-57210. Check NVD for updates.
Is there a patch for CVE-2026-57210?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.