CVE-2026-57210: CWE-20: Improper Input Validation in dadrus heimdall

Heimdall, a cloud native Identity Aware Proxy and Access Control Decision service, versions before 0.17.17 have an improper input validation vulnerability (CWE-20) related to client IP address extraction. When the trusted_proxies option is configured, Heimdall extracts IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them to the rule pipeline as Request.ClientIPAddresses. However, these extracted values are not validated for syntactic correctness, allowing arbitrary strings, malformed IP literals, and unknown or obfuscated identifiers per RFC 7239 to be accepted. Additionally, the Forwarded header parser splits on commas and semicolons without properly handling RFC 7239 quoted strings, which can cause a single quoted value to be split into multiple fragments, including trailing quote characters treated as separate addresses. This issue could lead to incorrect access control decisions based on malformed client IP data. The vulnerability is patched in Heimdall version 0.17.17.

The vulnerability allows attackers to supply arbitrary or malformed IP address values in Forwarded and X-Forwarded-For headers, potentially bypassing or confusing access control rules that rely on client IP addresses. This can lead to unauthorized access or incorrect policy enforcement. The issue affects the integrity of client IP address validation in the request processing pipeline.

Upgrade Heimdall to version 0.17.17 or later, where this input validation issue has been fixed. No other mitigation is required as the vendor has provided an official fix.