CVE-2026-57209

Name of the Vulnerable Software and Affected Versions Heimdall (affected versions not specified)

Description When operating in proxy mode, the software constructs the Forwarded HTTP header by inserting the Host header value from incoming requests without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, which can lead to IP spoofing for upstream services. Upstream services parsing the header according to RFC 7239 may trust the injected for= value, potentially allowing an attacker to bypass IP-based access controls for internal APIs or admin panels.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.