Live › vulnerability › CVE-2026-57209
Go to dashboardIn Heimdall's proxy mode, the Host header value is copied into the Forwarded header without removing commas or semicolons. An attacker can add extra parameters to that header and spoof client IP addresses seen by upstream services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Heimdall as an identity-aware proxy in proxy mode before version 0.17.17, where upstream services use the Forwarded header for client IP or access decisions. Deployments that do not use proxy mode, or whose upstreams ignore Forwarded, are less exposed. The sources do not say how the attacker sends the request.
No product ranges from the sources yet.
heimdall version or check the deployed image tag to see whether the version is below 0.17.170.17.17 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.
This page as .md · .json · in your agent: get_signal("CVE-2026-57209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.