# CVE-2026-57209: Heimdall Forwarded header injection in proxy mode

Source: https://junglewise.ai/threats/cve-2026-57209-heimdall-forwarded-header-injection-via-unsanitized-host-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-57209 · Severity: medium · CVSS 4 · Published 2026-10-23

Heimdall is a cloud-native proxy that sits between users and internal services to enforce access control policies. In proxy mode, it improperly constructs HTTP headers when forwarding requests, allowing an attacker to inject forged values that spoof the client's IP address to upstream services. This can enable bypassing IP-based access restrictions and trusting malicious origins as legitimate internal clients.

Technologies: [Dadrus Heimdall](https://junglewise.ai/threats/technologies/heimdall), [github.com/dadrus/heimdall (Go)](https://junglewise.ai/threats/technologies/github-com-dadrus-heimdall). Vendors: [Dadrus](https://junglewise.ai/threats/vendors/dadrus), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-57209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57209 being exploited in the wild.

**How severe is CVE-2026-57209?** Medium severity, with a CVSS score of 4, published 23 October 2026.

**Which products and versions are affected?** Dadrus Heimdall prior to 0.17.17; github.com/dadrus/heimdall (Go) SEMVER:introduced=0,fixed=0.17.17.

**Is there a fix for CVE-2026-57209?** Yes. github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57209 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-57209?** Check whether you run Dadrus Heimdall or github.com/dadrus/heimdall (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later

  ```sh
  go get github.com/dadrus/heimdall@v0.17.17
  ```


## Technical details

The vulnerability is a header injection flaw in proxy request handling: Heimdall concatenates the Host header value directly into the Forwarded HTTP header without sanitizing commas or semicolons, allowing attackers to inject additional Forwarded header parameters. An unauthenticated attacker over the network can craft requests with a malicious Host header containing separators to inject a spoofed "for=" IP parameter, which upstream services parsing RFC 7239 Forwarded headers may trust as the real client IP. No authentication or special privileges are required; the fix is to sanitize Host header input before string concatenation.

## Affected products

- dadrus Heimdall prior to 0.17.17

## Identifiers

- CVE-2026-57209
- GHSA-4jgr-pg2m-m988
- GO-2026-5125

## Timeline

- 2026-06-17: disclosed
- 2026-06-15: patched

## References

- [https://github.com/dadrus/heimdall/releases/tag/v0.17.17](https://github.com/dadrus/heimdall/releases/tag/v0.17.17)
- [https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988](https://github.com/dadrus/heimdall/security/advisories/GHSA-4jgr-pg2m-m988)

## Related threats

- [Heimdall IP spoofing via unvalidated forwarding headers](https://junglewise.ai/threats/cve-2026-57210-heimdall-ip-spoofing-via-unvalidated-forwarding-headers)
- [dadrus Heimdall authorization bypass via path normalization mismatch](https://junglewise.ai/threats/cve-2026-42274-dadrus-heimdall-authorization-bypass-via-path-normalization)
- [Dadrus Heimdall case-sensitive host matching policy bypass](https://junglewise.ai/threats/cve-2026-42273-dadrus-heimdall-case-sensitive-host-matching-policy-bypass)
- [dadrus Heimdall authorization bypass via case-sensitive URL encoding](https://junglewise.ai/threats/cve-2026-42272-dadrus-heimdall-authorization-bypass-via-case-sensitive-url)
- [GO-2026-4742 - Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall](https://junglewise.ai/threats/cve-2026-32811-heimdall-path-received-via-envoy-grpc-corrupted-when-containing)