Heimdall CVE-2026-42274

Exploitation requires Heimdall rule configurations that use free named or unnamed wildcards (e.g., '' patterns in path matching) without additional path constraints. Example vulnerable patterns include rules like 'path: /user/' and 'path: /public/**' where one rule enforces stricter access controls than another. The vulnerability is exploitable against default Heimdal configurations when such wildcard rules exist. For URL-encoded slash variants (%2e%2e%2fadmin), the downstream service must have allow_encoded_slashes set to 'on' or 'no_decode'. No special authentication is required (PR:N per CVSS vector). Exploitation is NOT possible if upstream proxies or load balancers normalize paths before forwarding to Heimdall, or if rules avoid wildcard patterns in favor of exact path matching.

Real-world risk is HIGH despite moderate CVSS 7.8, driven by the network attack vector (AV:N), low complexity (AC:L), and no authentication requirement (PR:N) enabling trivial remote exploitation. The CVSS 4.0 vector shows high confidentiality and integrity impact on subsequent systems (SC:H/SI:H), reflecting the vulnerability's position as an authorization gateway bypass rather than direct data compromise. GitHub security advisory GHSA-3q34-rx83-r6mq confirms this is an authorization bypass affecting access control enforcement, with potential for data exposure and privilege escalation depending on downstream services. EPSS and KEV data not provided in input, but the simplicity of exploitation (basic path traversal techniques known since the 1990s) combined with Heimdall's role as a security control layer suggests significant real-world risk for organizations using affected versions. Vulnerability is exploitable against default configurations when wildcards are used in rules without additional path validation. The vendor-confirmed impact includes unauthorized access to restricted data, invocation of privileged functionality, and potential privilege escalation, making this a legitimate priority for remediation despite absence of confirmed active exploitation.

Attacker identifies a Heimdall deployment with separate rules for public (/public/) and authenticated (/user/) paths. Attacker sends HTTP request to /public/../user/sensitive-data with path traversal encoded as /public/%2e%2e/user/sensitive-data if allow_encoded_slashes is configured. Heimdall matches the request against the '/public/**' rule permitting anonymous access, while the backend service normalizes the path to /user/sensitive-data and processes the request with full privileges, exposing restricted data or executing privileged operations without authentication.