Path Traversal in Dadrus Heimdall
CVE-2026-42274
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments…
EPSS: 0.001 (19.3th percentile) — read the EPSS interpretation.
Affected products
- Dadrus Heimdall — versions < 0.17.14
Weakness classification (CWE)
References
- https://github.com/dadrus/heimdall/security/advisories/GHSA-3q34-rx83-r6mq (x_refsource_CONFIRM)
- https://github.com/dadrus/heimdall/pull/3209 (x_refsource_MISC)
- https://github.com/dadrus/heimdall/commit/b5dfa484b7a8c2ce6d8691c026f9da867719947a (x_refsource_MISC)
- https://github.com/dadrus/heimdall/releases/tag/v0.17.14 (x_refsource_MISC)