CVE-2026-42274 Heimdall: Authorization bypass via path normalization mismatch
Attackers can bypass authorization checks by exploiting path normalization mismatches between the proxy and downstream services, gaining unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42274?
CVE-2026-42274 is a high-severity authentication bypass vulnerability in dadrus heimdall, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14.
Which versions are affected by CVE-2026-42274?
3 open source packages ship an affected version, including github.com/dadrus/heimdall.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dadrus/heimdall Go | All versions | 0.17.14 |
github.com/dadrus/heimdall Go | All versions | 0.17.14 |
github.com/dadrus/heimdall Go | All versions | 0.17.14 |
How do I fix CVE-2026-42274?
Upgrade github.com/dadrus/heimdall to 0.17.14 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-42274 being exploited?
There is no known exploitation of CVE-2026-42274 in the wild and no public exploit code.
Sources
Also known as GHSA-3q34-rx83-r6mq, GO-2026-5097.