CVE-2026-57210

Name of the Vulnerable Software and Affected Versions heimdall (affected versions not specified)

Description When the trusted proxies option is enabled, the software extracts client IP addresses from the Forwarded (specifically the for= parameter) and X-Forwarded-For headers, exposing them via Request.ClientIPAddresses. The system fails to validate if these extracted values are syntactically valid IP addresses, allowing arbitrary strings, malformed IP literals, obfuscated identifiers, and RFC 7239 unknown values. Furthermore, the Forwarded header parser incorrectly handles RFC 7239 quoted strings by splitting on commas and semicolons, which can result in a single quoted value being parsed as multiple independent addresses containing malformed fragments.

This issue can lead to the manipulation of rule evaluation in deployments where Request.ClientIPAddresses is used for security decisions, such as in a CEL authorizer using the networks() function, potentially allowing attackers to bypass access control logic. In proxy mode, these unvalidated values are propagated unchanged to upstream services via X-Forwarded-For and Forwarded headers, enabling IP spoofing against those services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Ensure at the network level that only trusted proxies can communicate directly with heimdall. Ensure that the proxy forwarding requests to heimdall sanitizes or overrides Forwarded or X-Forwarded-For headers before forwarding. Avoid relying on Request.ClientIPAddresses for security-sensitive decisions.