CVE-2026-82477: CWE-918 Server-Side Request Forgery (SSRF) in MITRE Heimdall

This vulnerability (CWE-918) affects MITRE SAF Heimdall in versions 2.11.6 through 2.13.x prior to 2.14.0. It arises from improper validation of requests to the Tenable proxy endpoint, enabling an attacker to perform SSRF attacks. This can lead to unauthorized access to internal network resources. The vulnerability is identified in the source code at apps/backend/src/tenable/tenable.controller.ts. The CVSS 3.1 base score is 5.8, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, integrity impact low, and no availability impact.

The SSRF vulnerability allows remote attackers to make requests from the vulnerable Heimdall server to internal network resources that are otherwise inaccessible externally. This could lead to information disclosure or further internal network reconnaissance. There is no direct confidentiality impact reported, but integrity impact is low. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor MITRE's advisories for updates and apply any official patches once released. Until then, consider restricting access to the Tenable proxy endpoint or implementing network-level controls to limit SSRF exploitation.