dadrus Heimdall Forwarded header injection in proxy mode

Executive brief

Heimdall, an identity and access proxy, contains a vulnerability that allows attackers to spoof their identity when communicating with internal services. By sending a specially crafted web request, an attacker can trick backend applications into believing the request came from a trusted or internal network address. This can lead to unauthorized access to administrative panels or internal data that is normally protected by network restrictions.

Technical details

When operating in proxy mode, Heimdall constructs the RFC 7239 'Forwarded' HTTP header by concatenating the incoming request's Host header directly into the string without sanitizing delimiters like commas or semicolons. Because Go's net/http library permits these characters in the Host header, an attacker can inject additional 'for=' parameters. Upstream services that parse this header may trust the injected values, leading to IP spoofing and bypass of IP-based access control lists (ACLs). The vulnerability is located in proxy/request_context.go and is fixed in version 0.17.17.

Affected products

• dadrus Heimdall <= 0.17.16

Timeline

• 2026-06-17: disclosed
• 2026-06-18: advisory

References

• https://api.github.com/users/tikket1
• https://github.com/tikket1
• https://api.github.com/users/tikket1/gists%7B/gist_id%7D
• https://api.github.com/users/tikket1/repos
• https://avatars.githubusercontent.com/u/196829696?v=4
• https://api.github.com/users/tikket1/events%7B/privacy%7D