CVE-2026-57209: CWE-20: Improper Input Validation in dadrus heimdall

Heimdall, a cloud native Identity Aware Proxy and Access Control Decision service, versions before 0.17.17 have a vulnerability due to improper input validation (CWE-20). When operating in proxy mode, it builds the Forwarded HTTP header after rule processing by inserting the Host header value from incoming requests directly into the header string without sanitizing special characters such as commas or semicolons. This flaw enables attackers to inject additional parameters into the Forwarded header, which can be used to spoof IP addresses seen by upstream services. The vulnerability is addressed in version 0.17.17.

An attacker can exploit this vulnerability to inject arbitrary parameters into the Forwarded HTTP header, potentially spoofing IP addresses for upstream services. This may affect access control decisions or logging based on IP addresses, leading to unauthorized access or evasion of security controls. There are no known exploits in the wild as of the publication date.

Upgrade Heimdall to version 0.17.17 or later, where this vulnerability has been patched. No additional mitigation steps are indicated by the vendor advisory.