---
id: "CVE-2026-57209"
kind: "vulnerability"
aliases: ["CVE-2026-57209"]
title: "Heimdall: Host header injection lets attackers spoof Forwarded header in proxy mode"
severity: "high"
cvss: 7.0
epss: 0.00461
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["heimdall", "kubernetes", "other", "self-hosted"]
not_affected_if: ["no-proxy-mode", "version-0.17.17-or-later"]
published_at: "2026-10-23T13:17:11+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57209", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-57209", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Heimdall: Host header injection lets attackers spoof Forwarded header in proxy mode

In Heimdall's proxy mode, the Host header value is copied into the Forwarded header without removing commas or semicolons. An attacker can add extra parameters to that header and spoof client IP addresses seen by upstream services.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `heimdall version` or check the deployed image tag to see whether the version is below `0.17.17`
- Check whether Heimdall runs in proxy mode and whether upstream services trust the Forwarded header for IP addresses or access decisions

## Fix

- Upgrade Heimdall to `0.17.17` or later
- Until upgraded, do not rely on the Forwarded header from upstream services for IP-based access decisions

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-57209
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-57209

## From the sources

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_