CVE-2026-82477

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-82477
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82477.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-82477
Aliases
  • GHSA-g9vx-2rpf-gpch
Published
2026-08-29T14:12:42.797Z
Modified
2026-09-03T03:30:51.247255331Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82477.json",
    "cna_assigner": "mitre",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/mitre/heimdall2

Affected ranges

Type
GIT
Repo
https://github.com/mitre/heimdall2
Events
Introduced
f14832422f30e9dd98fe9f32440ce8fe02f8eb80
Fixed
abf4030218818f723a40b962c360acb03cc72789
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.11.6"
        },
        {
            "fixed": "2.14.0"
        }
    ]
}

Affected versions

Other
pre-monorepo-modernization
pre-vue3-migration
v2.*
v2.11.6
v2.12.0
v2.12.1
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.12.6
v2.13.0
v2.13.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82477.json"