Is CVE-2026-57209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57209 being exploited in the wild.

How severe is CVE-2026-57209?

Medium severity, with a CVSS score of 4, published 23 October 2026.

Which products and versions are affected?

Dadrus Heimdall prior to 0.17.17; github.com/dadrus/heimdall (Go) SEMVER:introduced=0,fixed=0.17.17.

Is there a fix for CVE-2026-57209?

Yes. github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57209 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-57209?

Check whether you run Dadrus Heimdall or github.com/dadrus/heimdall (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57209: Heimdall Forwarded header injection in proxy mode

CVE-2026-57209 · Severity: medium · CVSS 4 · Published 2026-10-23

Heimdall is a cloud-native proxy that sits between users and internal services to enforce access control policies. In proxy mode, it improperly constructs HTTP headers when forwarding requests, allowing an attacker to inject forged values that spoof the client's IP address to upstream services. This can enable bypassing IP-based access restrictions and trusting malicious origins as legitimate internal clients.

Technologies: Dadrus Heimdall, github.com/dadrus/heimdall (Go). Vendors: Dadrus, Go.

Quick answers

Is CVE-2026-57209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57209 being exploited in the wild.
How severe is CVE-2026-57209?: Medium severity, with a CVSS score of 4, published 23 October 2026.
Which products and versions are affected?: Dadrus Heimdall prior to 0.17.17; github.com/dadrus/heimdall (Go) SEMVER:introduced=0,fixed=0.17.17.
Is there a fix for CVE-2026-57209?: Yes. github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57209 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-57209?: Check whether you run Dadrus Heimdall or github.com/dadrus/heimdall (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later
```
go get github.com/dadrus/heimdall@v0.17.17
```

Technical details

The vulnerability is a header injection flaw in proxy request handling: Heimdall concatenates the Host header value directly into the Forwarded HTTP header without sanitizing commas or semicolons, allowing attackers to inject additional Forwarded header parameters. An unauthenticated attacker over the network can craft requests with a malicious Host header containing separators to inject a spoofed "for=" IP parameter, which upstream services parsing RFC 7239 Forwarded headers may trust as the real client IP. No authentication or special privileges are required; the fix is to sanitize Host header input before string concatenation.

Affected products

dadrus Heimdall prior to 0.17.17

Identifiers

CVE-2026-57209
GHSA-4jgr-pg2m-m988
GO-2026-5125

Timeline

2026-06-17: disclosed
2026-06-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.