# CVE-2026-57210: Heimdall IP spoofing via unvalidated forwarding headers

Source: https://junglewise.ai/threats/cve-2026-57210-heimdall-ip-spoofing-via-unvalidated-forwarding-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-57210 · Severity: medium · CVSS 4 · Published 2026-10-23

Heimdall is a cloud-native identity and access control proxy that sits between clients and backend services. When configured to trust forwarding headers, it can be tricked into accepting malformed or arbitrary strings as client IP addresses, allowing attackers to spoof their origin and potentially bypass IP-based access controls or inject false information into upstream services.

Technologies: [github.com/dadrus/heimdall (Go)](https://junglewise.ai/threats/technologies/github-com-dadrus-heimdall). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-57210 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57210 being exploited in the wild.

**How severe is CVE-2026-57210?** Medium severity, with a CVSS score of 4, published 23 October 2026.

**Which products and versions are affected?** github.com/dadrus/heimdall (Go) SEMVER:introduced=0,fixed=0.17.17; https://github.com/dadrus/heimdall (Go) SEMVER:introduced=0,fixed=0.17.17; Heimdall prior to 0.17.17.

**Is there a fix for CVE-2026-57210?** Yes. github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later; https://github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later. Until then: Ensure at the network level that only trusted proxies can communicate directly with Heimdall. Configure proxies to sanitize or override (not merely append to) Forwarded or X-Forwarded-For headers before forwarding requests. Avoid relying on Request.ClientIPAddresses for security-sensitive decisions until the patched version is deployed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57210 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57210?** Check whether you run github.com/dadrus/heimdall (Go), https://github.com/dadrus/heimdall (Go) or Heimdall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later

  ```sh
  go get github.com/dadrus/heimdall@v0.17.17
  ```

- https://github.com/dadrus/heimdall (Go): upgrade to 0.17.17 or later

  ```sh
  go get https://github.com/dadrus/heimdall@v0.17.17
  ```


Ensure at the network level that only trusted proxies can communicate directly with Heimdall. Configure proxies to sanitize or override (not merely append to) Forwarded or X-Forwarded-For headers before forwarding requests. Avoid relying on Request.ClientIPAddresses for security-sensitive decisions until the patched version is deployed.

## Technical details

The vulnerability stems from insufficient validation of client IP addresses extracted from the Forwarded and X-Forwarded-For headers when trusted_proxies is configured. Arbitrary strings, malformed IP literals, and RFC 7239 obfuscated identifiers are accepted without syntactic validation. Additionally, the Forwarded header parser incorrectly splits on commas and semicolons without respecting RFC 7239 quoted strings, causing quoted values with embedded delimiters to be misparsed into multiple entries with fragments including trailing quotes. Attackers with ability to send or influence these headers can inject values that affect rule evaluation or propagate to upstream services.

## Affected products

- Heimdall Heimdall prior to 0.17.17

## Identifiers

- CVE-2026-57210
- GHSA-38x9-25wx-7fg2
- GO-2026-5075

## Timeline

- 2026-06-17: disclosed
- 2026-06-15: patched: version 0.17.17 released
- 2026-10-23: advisory: CVE-2026-57210 published

## References

- [https://github.com/dadrus/heimdall/releases/tag/v0.17.17](https://github.com/dadrus/heimdall/releases/tag/v0.17.17)
- [https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2](https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2)

## Related threats

- [Heimdall Forwarded header injection in proxy mode](https://junglewise.ai/threats/cve-2026-57209-heimdall-forwarded-header-injection-via-unsanitized-host-header)
- [dadrus Heimdall authorization bypass via path normalization mismatch](https://junglewise.ai/threats/cve-2026-42274-dadrus-heimdall-authorization-bypass-via-path-normalization)
- [Dadrus Heimdall case-sensitive host matching policy bypass](https://junglewise.ai/threats/cve-2026-42273-dadrus-heimdall-case-sensitive-host-matching-policy-bypass)
- [dadrus Heimdall authorization bypass via case-sensitive URL encoding](https://junglewise.ai/threats/cve-2026-42272-dadrus-heimdall-authorization-bypass-via-case-sensitive-url)
- [GO-2026-4742 - Heimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall](https://junglewise.ai/threats/cve-2026-32811-heimdall-path-received-via-envoy-grpc-corrupted-when-containing)