Executive brief
Heimdall, a cloud-native policy engine and API gateway, contains a vulnerability that allows attackers to spoof their IP address. By sending specially crafted network headers, an attacker can trick the system into believing a request is coming from a trusted location, potentially bypassing security rules or misleading downstream services. This could lead to unauthorized access to protected resources or the bypass of IP-based security restrictions.
Technical details
Heimdall fails to validate the syntax of IP addresses extracted from 'Forwarded' (for=) and 'X-Forwarded-For' headers when the 'trusted_proxies' configuration is active. The parser for the 'Forwarded' header incorrectly splits values on delimiters without respecting RFC 7239 quoted strings, allowing for the injection of arbitrary strings or malformed IP literals into the 'Request.ClientIPAddresses' property. An attacker can exploit this to bypass CEL-based network authorization rules or spoof IP identities to upstream services in proxy mode. The vulnerability is exploitable if Heimdall is configured to trust proxies and the rule pipeline relies on client IP metadata for security decisions. A fix is available in version 0.17.17.
Affected products
- dadrus Heimdall <= 0.17.16
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory
- 2026-06-17: patched: Version 0.17.17 released