dadrus heimdall up to 0.17.13 interpretation conflict

Summaryinfo

A vulnerability was found in dadrus heimdall up to 0.17.13. It has been rated as critical. This vulnerability affects unknown code. The manipulation leads to interpretation conflict. This vulnerability is documented as CVE-2026-42272. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in dadrus heimdall up to 0.17.13. This issue affects an unknown function. The manipulation with an unknown input leads to a interpretation conflict vulnerability. Using CWE to declare the problem leads to CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-42272 since 04/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.17.14 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• dadrus

Name

• heimdall

Version

• 0.17.0
• 0.17.1
• 0.17.2
• 0.17.3
• 0.17.4
• 0.17.5
• 0.17.6
• 0.17.7
• 0.17.8
• 0.17.9
• 0.17.10
• 0.17.11
• 0.17.12
• 0.17.13

Website

• Product: https://github.com/dadrus/heimdall/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion