CVE-2026-42272: CWE-436: Interpretation Conflict in dadrus heimdall
CVE-2026-42272 is a vulnerability in dadrus heimdall, a cloud native Identity Aware Proxy and Access Control Decision service. Versions prior to 0.17.14 handle URL-encoded slashes (%2F) in a case-sensitive way, contrary to the case-insensitive definition of percent-encoding. This causes the lowercase equivalent (%2f) to be unrecognized and improperly processed when the default setting allow_encoded_slashes is off. This discrepancy can lead to differences in request path interpretation between heimdall and upstream components, potentially allowing authorization bypass. The issue has been fixed in version 0.17.14. The vulnerability has a CVSS 4.
AI Analysis
Technical Summary
Heimdall versions before 0.17.14 incorrectly treat URL-encoded slashes (%2F) case-sensitively, failing to recognize %2f as equivalent. Since percent-encoding is defined to be case-insensitive, this leads to inconsistent path interpretation between heimdall and upstream components when allow_encoded_slashes is off (default). This inconsistency can cause authorization bypass due to differing access control decisions. The vulnerability is tracked as CVE-2026-42272 with a high CVSS 4.0 score of 7.8. The issue has been patched in heimdall version 0.17.14.
Potential Impact
An attacker could exploit the inconsistent handling of URL-encoded slashes to bypass authorization controls in heimdall, potentially gaining unauthorized access. This impacts the integrity of access control decisions in affected versions prior to 0.17.14.
Mitigation Recommendations
Upgrade heimdall to version 0.17.14 or later, where this vulnerability is patched. Since this is not a cloud service, remediation requires applying the official fix by updating the software. Patch status is confirmed by the vendor advisory stating the issue is fixed in version 0.17.14.
CVE-2026-42272: CWE-436: Interpretation Conflict in dadrus heimdall
Description
CVE-2026-42272 is a vulnerability in dadrus heimdall, a cloud native Identity Aware Proxy and Access Control Decision service. Versions prior to 0.17.14 handle URL-encoded slashes (%2F) in a case-sensitive way, contrary to the case-insensitive definition of percent-encoding. This causes the lowercase equivalent (%2f) to be unrecognized and improperly processed when the default setting allow_encoded_slashes is off. This discrepancy can lead to differences in request path interpretation between heimdall and upstream components, potentially allowing authorization bypass. The issue has been fixed in version 0.17.14. The vulnerability has a CVSS 4.
CVSS v4.0
Score 7.8high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Heimdall versions before 0.17.14 incorrectly treat URL-encoded slashes (%2F) case-sensitively, failing to recognize %2f as equivalent. Since percent-encoding is defined to be case-insensitive, this leads to inconsistent path interpretation between heimdall and upstream components when allow_encoded_slashes is off (default). This inconsistency can cause authorization bypass due to differing access control decisions. The vulnerability is tracked as CVE-2026-42272 with a high CVSS 4.0 score of 7.8. The issue has been patched in heimdall version 0.17.14.
Potential Impact
An attacker could exploit the inconsistent handling of URL-encoded slashes to bypass authorization controls in heimdall, potentially gaining unauthorized access. This impacts the integrity of access control decisions in affected versions prior to 0.17.14.
Mitigation Recommendations
Upgrade heimdall to version 0.17.14 or later, where this vulnerability is patched. Since this is not a cloud service, remediation requires applying the official fix by updating the software. Patch status is confirmed by the vendor advisory stating the issue is fixed in version 0.17.14.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-26T11:53:27.707Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69fd5dbdcbff5d86108b6467
Added to database: 05/08/2026, 03:51:25 UTC
Last enriched: 05/15/2026, 10:50:11 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.