What is the CVSS score of CVE-2026-12357?

CVE-2026-12357 has a CVSS 3.0 base score of 7.2 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of Heimdall Database Proxy are affected by CVE-2026-12357?

Heimdall Data Database Proxy contains a remote code execution vulnerability (CVE-2026-12357) that allows privileged database administrators to execute arbitrary commands and gain root-level access to…

How to fix or mitigate CVE-2026-12357?

Within 24 hours, inventory all Heimdall Data Database Proxy deployments across your infrastructure, document the current version running on each instance, and review which users and systems have been granted high-privilege administrative access; simultaneously enable detailed audit logging on the generateFileContent function to detect CRLF injection attempts. Within 7 days, implement network-level access restrictions to limit authentication to only necessary internal systems and users, enforce multi-factor authentication for administrative access, and review all high-privilege account activity logs for unauthorized patterns; brief your database operations and security teams on the vulnerability and interim controls. Within 30 days, establish formal monitoring of Heimdall Data vendor security advisories, prepare a tested upgrade plan for immediate deployment upon patch release, and evaluate alternative database proxy solutions with stronger patch cadence.

Heimdall Database Proxy CVE-2026-12357

EUVD-2026-50487 HIGH

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-07-29 zdi

GHSA-c2fc-3q38-9pf4

RCE Database Proxy

7.2

CVSS 3.0 · Vendor: zdi

Severity by source

Vendor (zdi) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable, low-complexity CRLF injection but requires high-privilege authenticated access (PR:H); yields root code execution so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (zdi).

CVSS VectorVendor: zdi

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 19:58 vuln.today

CVE Published

Jul 29, 2026 - 19:04 cve.org

HIGH 7.2

DescriptionCVE.org

Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Heimdall Data Database Proxy. Authentication is required to exploit this vulnerability.

The specific flaw exists within the generateFileContent function. The issue results from the lack of proper neutralization of CRLF sequences. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-29251.

AnalysisAI

Remote code execution in Heimdall Data Database Proxy lets an authenticated, high-privileged attacker inject CRLF sequences into the generateFileContent function to run arbitrary commands as root (ZDI-26-447, formerly ZDI-CAN-29251). The flaw carries a CVSS 7.2 (PR:H) rating and was reported through the Zero Day Initiative; no public exploit identified at time of analysis and it is not on CISA KEV, so exploitation risk is currently theoretical but the root-level impact is severe.

Technical ContextAI

Heimdall Data Database Proxy is a middleware layer that sits between applications and backend SQL databases to provide connection pooling, query caching, read/write splitting, and load balancing. The root cause is CWE-93 (Improper Neutralization of CRLF Sequences): the generateFileContent function fails to strip or escape carriage-return/line-feed characters before writing attacker-influenced data into a file or downstream command context. Because injected CRLF sequences can break the intended structure of the generated content, an attacker can smuggle additional directives that the proxy - running as root - subsequently executes, converting a data-neutralization bug into full command execution. The single CPE in scope, cpe:2.3:a:heimdall_data:database_proxy, confirms the vulnerable component is the proxy application itself rather than a bundled third-party library.

RemediationAI

No vendor-released patch or fixed version was identified in the available data, and the CPE lists all versions as affected, so the primary action is to consult the ZDI advisory at https://www.zerodayinitiative.com/advisories/ZDI-26-447/ and contact Heimdall Data for a patched build, then upgrade as soon as a fixed release is published. Because the vulnerability requires high privileges (PR:H), the most effective compensating control is to tightly restrict who holds administrative/management access to the proxy - enforce least privilege on proxy admin accounts, use unique strong credentials, and place the management interface behind network segmentation or a bastion so only trusted operators can reach the functions that invoke generateFileContent; the trade-off is added operational friction for legitimate administrators. Additionally, monitor the proxy host for unexpected root-level process execution and file writes, and audit configuration/file-generation activity for anomalous CRLF-laden input, accepting that this is detection rather than prevention.