Executive brief
Heimdall, an identity and access proxy, is vulnerable to an authorization bypass. An attacker can use specially crafted web addresses containing relative path sequences (like /../) to trick the system into applying security rules for a public area to a restricted area. This could allow unauthorized users to access sensitive data or perform administrative actions without proper authentication.
Technical details
Heimdall performs rule matching on raw, non-normalized request paths, while downstream components may normalize dot-segments (RFC 3986). An attacker can exploit this by using path traversal sequences (e.g., /public/../admin) to match a permissive rule in Heimdall while the downstream service resolves the path to a restricted resource. This is particularly effective when Heimdall is configured with wildcard routes. The vulnerability is addressed in version 0.17.14. Workarounds include enforcing path normalization at the ingress/proxy layer (e.g., using Envoy's normalize_path) or validating rule IDs within issued JWTs.
Affected products
- dadrus Heimdall < 0.17.14
Timeline
- 2026-04-21: disclosed: Advisory published by dadrus
- 2026-04-25: advisory: GitHub Advisory published
- 2026-04-25: patched: Fix released in version 0.17.14
References
- https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq
- https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
- https://www.rfc-editor.org/rfc/rfc3986
- https://github.com/dadrus/heimdall/pull/3209
- https://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a