CVE-2026-57210— Heimdall: IP Spoofing via Unvalidated Forwarding Headers
Quick assessment
Affected
dadrus heimdall
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Heimdall 是一款云原生的身份感知代理（Identity Aware Proxy）与访问控制决策服务。在版本 0.17.17 之前，当配置了 选项时，Heimdall 会从 （ 参数）和 请求头中提取客户端 IP 地址，并将其作为 暴露给规则处理管道。然而，提取出的值并未经过语法有效性验证，导致任意字符串、格式错误的 IP 字面量、以及符合 RFC 7239 的未知值或混淆标识符均可被接受，而无需进一步检查。 此外， 请求头解析器在遇到逗号（ ）和分号（ ）时即进行分割，但未考虑 RFC 7239 中定义的带
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1203 · Exploitation for Client Execution T1070 · Indicator Removal
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-57210
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Heimdall: IP Spoofing via Unvalidated Forwarding Headers
Source: CVE Program / CVE List V5
Vulnerability Description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-57210
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57210
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-57210 (1)
Vendor Pages for CVE-2026-57210 (1)
-
🔗 Release v0.17.17 · dadrus/heimdall · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: heimdall
-
CVE-2026-57209
Heimdall: Forwarded Header Injection via Unsanitized Host He -
CVE-2026-107449
Heimdall<=2.8.3存在SSRF漏洞 -
CVE-2026-82477
MITRE SAF Heimdall 2.11.6至2.13.x SSRF漏洞 -
CVE-2026-42274
Heimdall: Authorization bypass via path normalization mismat -
CVE-2026-42273
Heimdall: Case-sensitive host matching may lead to policy by
Same vendor: dadrus
-
CVE-2026-57209
Heimdall: Forwarded Header Injection via Unsanitized Host He -
CVE-2026-42274
Heimdall: Authorization bypass via path normalization mismat -
CVE-2026-42273
Heimdall: Case-sensitive host matching may lead to policy by -
CVE-2026-42272
Heimdall: Case-sensitive handling of URL-encoded slashes may -
CVE-2026-32811
Heimdall: Path received via Envoy gRPC corrupted when contai
Same weakness: CWE-20
-
CVE-2026-115883
LangGraph: Namespace labels containing `.` reach other names -
CVE-2026-55444
Goobi viewer: Solr query injection via the legacy RSS servle -
CVE-2026-55442
Goobi viewer: cleanUpQuery double-brace bypass allows arbitr -
CVE-2026-115479
baserCMS: Mail-form auto-replies accept multiple visitor-con -
CVE-2026-57209
Heimdall: Forwarded Header Injection via Unsanitized Host He
V. Comments for CVE-2026-57210
No comments yet