Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42272Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

High 7.8

In plain English

A high-severity security flaw in heimdall from dadrus. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.8High

Exploit odds (30 days)0.4%top 66.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/dadrus/heimdall	0.17.14	GHSA-43jv-5j4x-qv67
Go	github.com/dadrus/heimdall	0.17.14	GO-2026-5108

Affected products (as reported)

Vendor	Product	Versions
dadrus	heimdall	< 0.17.14

Weakness: CWE-436, CWE-178 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67 x_refsource_CONFIRM
https://github.com/dadrus/heimdall/pull/3207 x_refsource_MISC
https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351 x_refsource_MISC
https://github.com/dadrus/heimdall/releases/tag/v0.17.14 x_refsource_MISC