CVE-2026-42274

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42274

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42274.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42274

Aliases

Published

2026-05-08T03:43:41.597Z

Modified

2026-07-15T01:48:58.561598879Z

Severity

7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator

Summary

Heimdall: Authorization bypass via path normalization mismatch

Details

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allowencodedslashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-35",
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42274.json"
}

References

Affected packages

Git / github.com/dadrus/heimdall

Affected ranges

Type

GIT

Repo

https://github.com/dadrus/heimdall

Events

Introduced

Fixed

b5dfa484b7a8c2ce6d8691c026f9da867719947a

Fixed

c89e65c0d7cc0c2456c067836614ab9190771088

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.17.14"
        }
    ]
}

Affected versions

v0.*

v0.1.0-alpha

v0.10.0-alpha

v0.10.1-alpha

v0.11.0-alpha

v0.11.1-alpha

v0.12.0-alpha

v0.13.0-alpha

v0.14.0-alpha

v0.15.0

v0.16.0

v0.17.0

v0.17.1

v0.17.10

v0.17.11

v0.17.12

v0.17.13

v0.17.2

v0.17.3

v0.17.4

v0.17.5

v0.17.6

v0.17.7

v0.17.8

v0.17.9

v0.2.0-alpha

v0.3.0-alpha

v0.4.0-alpha

v0.4.1-alpha

v0.5.0-alpha

v0.6.0-alpha

v0.6.1-alpha

v0.7.0-alpha

v0.8.0-alpha

v0.8.1-alpha

v0.8.2-alpha

v0.9.0-alpha

v0.9.1-alpha

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42274.json"