dadrus heimdall up to 0.17.13 path traversal

Summaryinfo

A vulnerability classified as critical has been found in dadrus heimdall up to 0.17.13. This impacts an unknown function. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2026-42274. The attack is possible to be carried out remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in dadrus heimdall up to 0.17.13. It has been rated as critical. This issue affects some unknown processing. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-35. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-42274 since 04/26/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1006 for this issue.

Upgrading to version 0.17.14 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• dadrus

Name

• heimdall

Version

• 0.17.0
• 0.17.1
• 0.17.2
• 0.17.3
• 0.17.4
• 0.17.5
• 0.17.6
• 0.17.7
• 0.17.8
• 0.17.9
• 0.17.10
• 0.17.11
• 0.17.12
• 0.17.13

Website

• Product: https://github.com/dadrus/heimdall/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion