CVE-2026-57210

🎯 CVE-2026-57210 🧪 PoC 🇪🇺 EUVD

💬 0 Diskussion 📄 .md Alle CVEs anzeigen ✕

CVE-2026-57210 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.

Klassifikation & Betroffenheit:

CWE-116CWE-20CWE-290 dadrus Heimdall < 0.17.17

Improper Encoding or Escaping of Output 🎯 High

The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

🛡️ Empfohlene Mitigation: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using the ESAPI Encoding control [REF-45] or a similar tool, library, or framework. These will help the programmer encode outputs in a manner less prone to e…

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-73 · User-Controlled Filename (High) CAPEC-81 · Web Server Logs Tampering (High) CAPEC-85 · AJAX Footprinting (Low) CAPEC-104 · Cross Zone Scripting (High)

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-55214 8.5 CVE-2026-40568 8.5 CVE-2024-45219 8.5 CVE-2026-105801 8.4 CVE-2026-82409 8.4

🩹 Patch verfügbar (OSV):

🩹 f1e837658d2ad6859679cd29fb3432015532945c (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 10/2026

Heute 07.11.

CVSS-Vektor-Analyse: 7.0

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CNA-Bewertung (GitHub_M): 7.0 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA…

Veröffentlicht:23.10.2026

Aktualisiert:23.10.2026 12:28

Assigner (CNA):GitHub_M

EUVD-ID:EUVD-2026-108750

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	CVEs	Anteil
≥90 %	785	0,2 %
≥50 %	3.557	0,9 %
≥10 %	13.139	3,2 %
<10 %	391.193	95,7 %

Tier

CVEs

Anteil

≥90 %

785

0,2 %

≥50 %

3.557

0,9 %

≥10 %

13.139

3,2 %

<10 %

391.193

95,7 %

7.0 HIGH

EPSS

0.3%

CVE-2026-57210 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

dadrus

CVE-2026-57210 | Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7

CWE-116 ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

vor 14 Tagen

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub