Executive brief
Heimdall is a compliance reporting and analysis platform that integrates with security scanning tools like Tenable. A vulnerability in the Tenable proxy endpoint allowed unauthenticated attackers to make arbitrary HTTP requests to internal network resources, potentially exposing sensitive systems and data that should only be accessible within a private network.
Technical details
An SSRF (Server-Side Request Forgery) vulnerability existed in the Tenable integration endpoint (apps/backend/src/tenable/tenable.controller.ts) in Heimdall versions 2.11.6 through 2.13.x. The vulnerable code did not validate or restrict the target host URLs passed to the Tenable proxy, allowing attackers to redirect requests to arbitrary internal network addresses. The fix in version 2.14.0 implemented authentication requirements, host URL allowlist validation, and explicit protocol enforcement. The vulnerability is network-reachable and does not require authentication or user interaction on the victim's part.
Affected products
- MITRE Heimdall 2.11.6 through 2.13.x before 2.14.0
Timeline
- 2026-08-29: disclosed
- 2026-08-24: patched: Patch released in v2.14.0